{"vuid":"VU#362332","idnumber":"362332","name":"Wind River Systems VxWorks debug service enabled by default","keywords":["VxWorks","debug service","17185/udp","wrs"],"overview":"### Overview ###\r\nSome products based on VxWorks have the WDB target agent debug service enabled by default.  This service provides read/write access to the device's memory and allows functions to be called.\r\n\r\n### Description ###\r\nThe VxWorks WDB target agent is a target-resident, run-time facility that is required for connecting host tools to a VxWorks target system during development. WDB is a selectable component in the VxWorks configuration and is enabled by default. The WDB debug agent access is not secured and does provide a security hole in a deployed system.\r\n\r\nIt is advisable for production systems to reconfigure VxWorks with only those components needed for deployed operation and to build it as the appropriate type of system image.  It is recommended to remove host development components such as the WDB target agent and debugging components (INCLUDE_WDB and INCLUDE_DEBUG) as well as other operating system components that are not required to support customer applications.\r\n\r\nConsult the VxWorks Kernel Programmer's guide for more information on WDB.<br/><br/>Additional information can be found in ICS-CERT advisory <a href=\"http://www.us-cert.gov/control_systems/pdf/ICSA-10-214-01_VxWorks_Vulnerabilities.pdf\">ICSA-10-214-01</a> and on the <a href=\"https://community.rapid7.com/community/metasploit/blog/2010/08/02/shiny-old-vxworks-vulnerabilities\">Metasploit Blog</a>.\r\n\r\n### Impact\r\nAn attacker can use the debug service to fully compromise the device.\r\n\r\n### Solution\r\n#### Disable debug agent\r\nVendors should remove the WDB target debug agent in their VxWorks based products by removing the INCLUDE_WDB &amp; INCLUDE_DEBUG components from their VxWorks Image.\r\n\r\n#### Restrict access\r\nAppropriate firewall rules should be implemented to restrict access to the debug service (17185/udp) to only trusted sources until vendors have released patches to disable it.\r\n\r\n### Acknowledgements\r\nThanks to HD Moore for reporting a wider scope with additional research related to this vulnerability.  Earlier public reports came from Bennett Todd and Shawn Merdinger.\r\n\r\nThis document was written by Jared Allar.","clean_desc":"The VxWorks WDB target agent is a target-resident, run-time facility that is required for connecting host tools to a VxWorks target system during development. WDB is a selectable component in the VxWorks configuration and is enabled by default. The WDB debug agent access is not secured and does provide a security hole in a deployed system. It is advisable for production systems to reconfigure VxWorks with only those components needed for deployed operation and to build it as the appropriate type of system image. It is recommended to remove host development components such as the WDB target agent and debugging components (INCLUDE_WDB and INCLUDE_DEBUG) as well as other operating system components that are not required to support customer applications. Consult the VxWorks Kernel Programmer's guide for more information on WDB. Additional information can be found in ICS-CERT advisory ICSA-10-214-01 and on the Metasploit Blog.","impact":"An attacker can use the debug service to fully compromise the device.","resolution":"Disable debug agent\nVendors should remove the WDB target debug agent in their VxWorks based products by removing the INCLUDE_WDB & INCLUDE_DEBUG components from their VxWorks Image.","workarounds":"Restrict access\nAppropriate firewall rules should be implemented to restrict access to the debug service (17185/udp) to only trusted sources until vendors have released patches to disable it.","sysaffected":"","thanks":"Thanks to HD Moore for reporting a wider scope with additional research related to this vulnerability. Earlier public reports came from Bennett Todd and Shawn Merdinger.","author":"This document was written by Jared Allar.","public":["http://www.cisco.com/warp/public/707/cisco-sa-20051116-7920.shtml","http://seclists.org/vuln-dev/2002/May/179","https://community.rapid7.com/community/metasploit/blog/2010/08/02/shiny-old-vxworks-vulnerabilities","http://www.us-cert.gov/control_systems/pdf/ICSA-10-214-01_VxWorks_Vulnerabilities.pdf","http://blogs.windriver.com/chauhan/2010/08/vxworks-secure.html","https://support.windriver.com/olsPortal/faces/maintenance/downloadDetails.jspx?contentId=033708","http://thesauceofutterpwnage.blogspot.com/2010/08/metasploit-vxworks-wdb-agent-attack.html","http://cwe.mitre.org/data/definitions/215.html","http://cwe.mitre.org/data/definitions/505.html"],"cveids":["CVE-2010-2965"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2010-06-10T19:55:07Z","publicdate":"2010-08-02T00:00:00Z","datefirstpublished":"2010-08-02T14:59:17Z","dateupdated":"2020-09-02T15:51:46.424474Z","revision":87,"vrda_d1_directreport":"1","vrda_d1_population":"4","vrda_d1_impact":"4","cam_widelyknown":"10","cam_exploitation":"0","cam_internetinfrastructure":"16","cam_population":"16","cam_impact":"15","cam_easeofexploitation":"15","cam_attackeraccessrequired":"8","cam_scorecurrent":"14.04","cam_scorecurrentwidelyknown":"19.44","cam_scorecurrentwidelyknownexploited":"30.24","ipprotocol":"udp","cvss_accessvector":"N","cvss_accesscomplexity":"L","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"C","cvss_exploitablity":null,"cvss_remediationlevel":"W","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"H","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"10","cvss_basevector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","cvss_temporalscore":"9.5","cvss_environmentalscore":"9.494769984","cvss_environmentalvector":"CDP:ND/TD:H/CR:ND/IR:ND/AR:ND","metric":14.04,"vulnote":17}