Multiple vulnerabilities in DNS Module of Siemens Nucleus Products
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2020-27736 CVE-2020-27737 CVE-2020-27738 |
| CWE-ID | CWE-170 CWE-125 CWE-788 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Nucleus NET Server applications / Other server solutions VSTAR Server applications / Other server solutions Nucleus Source Code Server applications / Other server solutions Nucleus RTOS Server applications / Other server solutions Nucleus ReadyStart Server applications / Other server solutions Nucleus 4 Server applications / Other server solutions |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Improper Null Termination
EUVDB-ID: #VU52204
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-27736
CWE-ID:
CWE-170 - Improper Null Termination
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. A remote attacker can cause a denial of service condition or leak the read memory.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNucleus NET: All versions
VSTAR: All versions
Nucleus Source Code: All versions
Nucleus RTOS: All versions
Nucleus ReadyStart: before 2017.02.3
Nucleus 4: before 4.1.0
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-705111.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Out-of-bounds read
EUVDB-ID: #VU52205
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-27737
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a boundary condition in the DNS response parsing functionality. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system or cause a denial of service (DoS) condition.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNucleus NET: All versions
VSTAR: All versions
Nucleus Source Code: All versions
Nucleus RTOS: All versions
Nucleus ReadyStart: before 2017.02.3
Nucleus 4: before 4.1.0
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-705111.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Access of Memory Location After End of Buffer
EUVDB-ID: #VU52206
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-27738
CWE-ID:
CWE-788 - Access of Memory Location After End of Buffer
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the DNS domain name record decompression functionality does not properly validate the pointer offset values. A remote attacker can cause a denial of service condition on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNucleus NET: All versions
VSTAR: All versions
Nucleus Source Code: All versions
Nucleus RTOS: All versions
Nucleus ReadyStart: before 2017.02.3
Nucleus 4: before 4.1.0
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-705111.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
