RTI Connext DDS 5.1.1.x < 5.1.1.5 / 5.2.3.x < 5.2.3.17 / 5.2.7 Multiple Vulnerabilities

critical Nessus Plugin ID 99476

Language:

Synopsis

An application installed on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Real Time Innovations (RTI) Connext Data Distribution Service (DDS) installed on the remote Windows host is 5.1.1.x prior to 5.1.1.5 or 5.2.3.x prior to either 5.2.3.17 or 5.2.7. It is, therefore, affected by multiple vulnerabilities :

- A heap-based buffer overflow condition exists that allows an unauthenticated, remote attacker to execute arbitrary code with system privileges.

- An integer overflow condition exists that allows an unauthenticated, remote attacker to execute arbitrary code with system privileges.

- A deserialization issue exists due to improper validation of user-supplied data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition and potentially the execution of arbitrary code.

- An out-of-bounds memory buffer issue exists that allows an unauthenticated, remote attacker to cause a denial of service condition and execute arbitrary code with system privileges.

Solution

Upgrade to RTI Connext DDS version 5.1.1.5 / 5.2.3.17 / 5.2.7 or later.

Note that customers with uncommon architectures may need to contact RTI for a custom patch. RTI is planning a major software release in June 2017 to address the vulnerabilities on all currently supported architectures.

Plugin Details

Severity: Critical

ID: 99476

File Name: rti_connext_dds_2017-A-0097.nasl

Version: 1.3

Type: local

Agent: windows

Family: Windows

Published: 4/19/2017

Updated: 6/3/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:rti:connext_dds

Required KB Items: Settings/ParanoidReport, installed_sw/RTI Connext DDS

Vulnerability Publication Date: 4/13/2017

Reference Information

IAVA: 2017-A-0097-S

Detections

Analytics