NVD Vulnerability Detail

CVE-2010-2965

Summary	The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185, a related issue to CVE-2005-3804.
Publication Date	Aug. 5, 2010, 10:22 p.m.
Registration Date	Jan. 29, 2021, 11:04 a.m.
Last Update	Nov. 21, 2024, 10:17 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:rockwellautomation:1756-enbt\/a_firmware:3.2.6:::::::*
cpe:2.3:o:rockwellautomation:1756-enbt\/a_firmware:3.6.1:::::::*
cpe:2.3:o:windriver:vxworks::::::::			6.9.4.12
execution environment
1	cpe:2.3:h:rockwellautomation:1756-enbt\/a:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html	Not Applicable
2	http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html	Not Applicable
3	http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=69735	Permissions Required
4	http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=69735	Permissions Required
5	http://www.kb.cert.org/vuls/id/362332	Third Party Advisory US Government Resource
6	http://www.kb.cert.org/vuls/id/362332	Third Party Advisory US Government Resource
7	http://www.kb.cert.org/vuls/id/MAPG-86EPFA	Third Party Advisory US Government Resource
8	http://www.kb.cert.org/vuls/id/MAPG-86EPFA	Third Party Advisory US Government Resource
9	http://www.kb.cert.org/vuls/id/MAPG-86FPQL	Third Party Advisory US Government Resource
10	http://www.kb.cert.org/vuls/id/MAPG-86FPQL	Third Party Advisory US Government Resource
11	https://support.windriver.com/olsPortal/faces/maintenance/downloadDetails.jspx?contentId=033708	Permissions Required
12	https://support.windriver.com/olsPortal/faces/maintenance/downloadDetails.jspx?contentId=033708	Permissions Required

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-863	不正な認証	https://cwe.mitre.org/data/definitions/863.html

JVN Vulnerability Information

Rockwell Automation 1756-ENBT series A で使用されている Wind River VxWorks における任意のメモリ領域を読まれる脆弱性

Title	Rockwell Automation 1756-ENBT series A で使用されている Wind River VxWorks における任意のメモリ領域を読まれる脆弱性
Summary	Rockwell Automation 1756-ENBT series A で使用されている Wind River VxWorks の WDB ターゲットエージェントデバックサービスには、任意のメモリ領域を読まれるまたは変更される、関数呼び出しを実行される、またはタスクを管理される脆弱性が存在します。本問題は、CVE-2005-3804 に関連する可能性があります。
Possible impacts	第三者により、UDP ポートへのリクエストを介して、任意のメモリ領域を読まれるまたは変更される、関数呼び出しを実行される、またはタスクを管理される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 5, 2010, midnight
Registration Date	Dec. 20, 2012, 7:29 p.m.
Last Update	Dec. 20, 2012, 7:29 p.m.

Affected System

Rockwell Automation

1756-enbt series a

1756-enbt series a firmware 3.2.6 および 3.6.1

ウインドリバー株式会社

VxWorks 6.x、5.x およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-2965	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2965
National Vulnerability Database (NVD)
2	CVE-2010-2965	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2965

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
rockwellautomation
1	Top Page	http://www.rockwellautomation.com/
Wind River
2	Top Page	http://windriver.com/index.html

その他

No	Name	URL
US-CERT Vulnerability Note
1	VU#362332	http://www.kb.cert.org/vuls/id/362332

Change Log

No	Changed Details	Date of change
0	[2012年12月20日] 掲載	Feb. 17, 2018, 10:37 a.m.