Summary
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerability described in this advisory is from this set.
The DNS client of of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains a vulnerability related to the handling of UDP port numbers in DNS requests that could allow an attacker to poison the DNS cache or spoof DNS resolving.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nuc…
Revision history
-
#3
Removed CAPITAL VSTAR as not affected
-
#2
Consolidated list of products
-
#1
Publication Date
References
-
SSA-201384: Predictable UDP Port Number Vulnerability (NAME:WRECK) in the DNS Module of Nucleus RTOS - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-201384.pdf
-
SSA-201384: Predictable UDP Port Number Vulnerability (NAME:WRECK) in the DNS Module of Nucleus RTOS - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-201384.txt