Skip to content
OpenAdvisories
Medium SSA-705111 4 CVEs

SSA-705111: Multiple Vulnerabilities (NAME:WRECK) in the DNS Module of Nucleus RTOS

Published Apr 13, 2021 · Updated Jan 11, 2022 · Revision 3

Vendor: Siemens Product: Nucleus NET Product: Nucleus ReadyStart V3 Product: Nucleus ReadyStart V4 Product: Nucleus Source Code

Summary

Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set.

The DNS client of affected products contains multiple vulnerabilities related to the handling of DNS responses and requests. The most severe could allow an attacker to manipulate the DNS responses and cause a denial-of-service condition.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.

Vulnerabilities 4

Revision history

  1. #3

    Removed CAPITAL VSTAR as not affected

  2. #2

    Added solution for CVE-2021-25677 in Nucleus ReadyStart V3; consolidated list of products

  3. #1

    Publication Date

References