FKIE_CVE-2013-2687

Vulnerability from fkie_nvd - Published: 2013-07-12 16:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868.
References
cve@mitre.orghttp://aluigi.altervista.org/adv/qnxph_1-adv.txtExploit
cve@mitre.orghttp://ics-cert.us-cert.gov/advisories/ICSA-13-189-01Patch, US Government Resource
cve@mitre.orghttp://www.qnx.com/download/feature.html?programid=24850Patch
af854a3a-2127-422b-91ae-364da2661108http://aluigi.altervista.org/adv/qnxph_1-adv.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01Patch, US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.qnx.com/download/feature.html?programid=24850Patch
Impacted products
Vendor Product Version
blackberry qnx_momentics_tool_suite *
blackberry qnx_momentics_tool_suite 4.5
blackberry qnx_momentics_tool_suite 4.6
blackberry qnx_momentics_tool_suite 4.7
blackberry qnx_momentics_tool_suite 6.5.0
blackberry qnx_software_development_platform -
blackberry qnx_neutrino_rtos *
blackberry qnx_neutrino_rtos 6.4.1
blackberry qnx_neutrino_rtos 6.5.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_momentics_tool_suite:*:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "1F184BC9-8E64-4976-8E3A-F6FF4C1593DB",
              "versionEndIncluding": "6.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_momentics_tool_suite:4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "A796624B-7F7A-4A92-B83E-D592096B9753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_momentics_tool_suite:4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "97DA1B48-77C6-4C30-816E-B0BC2FEF3401",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_momentics_tool_suite:4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "856700E9-717A-4CE1-A451-23090ACC0A56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_momentics_tool_suite:6.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7819F1A5-3519-4EEF-895D-B76A452BD4D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:blackberry:qnx_software_development_platform:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F053696-43DE-40F3-933F-8C01721D3D42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:blackberry:qnx_neutrino_rtos:*:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "3CF6AE0F-3167-47A8-9727-89DC0133C0B4",
              "versionEndIncluding": "6.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:blackberry:qnx_neutrino_rtos:6.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4476D9C6-C77C-4420-A629-38A8FA195640",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:blackberry:qnx_neutrino_rtos:6.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "19D877E0-F8F1-434F-97F3-1DD32883FA77",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2) QNX Momentics Tool Suite through 6.5.0 SP1 in the QNX Software Development Platform allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted packets to TCP port 4868."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n bpe_decompress en (1) BlackBerry QNX Neutrino RTOS hasta v6.5.0 SP1 y (2) QNX Momentics Tool Suite hasta v6.5.0 SP1 en QNX Software Development Platform, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda de la aplicacion) o posiblemente ejecutar c\u00f3digo a trav\u00e9s de paquetes sobre el puerto TCP 4868 manipulados."
    }
  ],
  "id": "CVE-2013-2687",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-07-12T16:55:01.037",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://aluigi.altervista.org/adv/qnxph_1-adv.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.qnx.com/download/feature.html?programid=24850"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://aluigi.altervista.org/adv/qnxph_1-adv.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "US Government Resource"
      ],
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-13-189-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.qnx.com/download/feature.html?programid=24850"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.