273 lines
11 KiB
JSON
273 lines
11 KiB
JSON
{
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"product": "eCosPro RTOS",
|
||
"vendor": "eCosCentric",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "4.5.3",
|
||
"status": "affected",
|
||
"version": " 2.0.1",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "HIGH",
|
||
"attackVector": "LOCAL",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 4.6,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "LOW",
|
||
"privilegesRequired": "HIGH",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "REQUIRED",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:H",
|
||
"version": "3.1"
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-190",
|
||
"description": "CWE-190 Integer Overflow or Wraparound",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"dateUpdated": "2022-05-03T20:17:54.000Z",
|
||
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
|
||
"shortName": "icscert"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Update eCosCentric eCosPro RTOS to version 4.5.4 or newer – Update available"
|
||
}
|
||
],
|
||
"source": {
|
||
"defect": [
|
||
"“BadAlloc”"
|
||
],
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "eCosCentric eCosPro RTOS Integer Overflow or Wraparound",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.0.9"
|
||
},
|
||
"x_legacyV4Record": {
|
||
"CVE_data_meta": {
|
||
"ASSIGNER": "ics-cert@hq.dhs.gov",
|
||
"ID": "CVE-2021-27417",
|
||
"STATE": "PUBLIC",
|
||
"TITLE": "eCosCentric eCosPro RTOS Integer Overflow or Wraparound"
|
||
},
|
||
"affects": {
|
||
"vendor": {
|
||
"vendor_data": [
|
||
{
|
||
"product": {
|
||
"product_data": [
|
||
{
|
||
"product_name": "eCosPro RTOS",
|
||
"version": {
|
||
"version_data": [
|
||
{
|
||
"version_affected": "<=",
|
||
"version_name": " 2.0.1",
|
||
"version_value": "4.5.3"
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"vendor_name": "eCosCentric"
|
||
}
|
||
]
|
||
}
|
||
},
|
||
"credit": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA."
|
||
}
|
||
],
|
||
"data_format": "MITRE",
|
||
"data_type": "CVE",
|
||
"data_version": "4.0",
|
||
"description": {
|
||
"description_data": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow."
|
||
}
|
||
]
|
||
},
|
||
"generator": {
|
||
"engine": "Vulnogram 0.0.9"
|
||
},
|
||
"impact": {
|
||
"cvss": {
|
||
"attackComplexity": "HIGH",
|
||
"attackVector": "LOCAL",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 4.6,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "LOW",
|
||
"privilegesRequired": "HIGH",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "REQUIRED",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:H",
|
||
"version": "3.1"
|
||
}
|
||
},
|
||
"problemtype": {
|
||
"problemtype_data": [
|
||
{
|
||
"description": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "CWE-190 Integer Overflow or Wraparound"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"references": {
|
||
"reference_data": [
|
||
{
|
||
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04",
|
||
"refsource": "CONFIRM",
|
||
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"
|
||
},
|
||
{
|
||
"name": "https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437",
|
||
"refsource": "CONFIRM",
|
||
"url": "https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437"
|
||
}
|
||
]
|
||
},
|
||
"solution": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Update eCosCentric eCosPro RTOS to version 4.5.4 or newer – Update available"
|
||
}
|
||
],
|
||
"source": {
|
||
"defect": [
|
||
"“BadAlloc”"
|
||
],
|
||
"discovery": "EXTERNAL"
|
||
}
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-03T20:48:17.190Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_CONFIRM",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04"
|
||
},
|
||
{
|
||
"tags": [
|
||
"x_refsource_CONFIRM",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-04-16T15:53:04.415991Z",
|
||
"id": "CVE-2021-27417",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-04-16T16:25:33.142Z"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"cveMetadata": {
|
||
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
|
||
"assignerShortName": "icscert",
|
||
"cveId": "CVE-2021-27417",
|
||
"datePublished": "2022-05-03T20:17:54.000Z",
|
||
"dateReserved": "2021-02-19T00:00:00.000Z",
|
||
"dateUpdated": "2025-04-16T16:25:33.142Z",
|
||
"state": "PUBLISHED"
|
||
},
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1"
|
||
} |