ID
VAR-202009-0292
CVE
CVE-2020-13995
TITLE
U.S. Air Force Sensor Data Management System extract75 Buffer Overflow Vulnerability in Linux
Trust: 0.8
DESCRIPTION
U.S. Air Force Sensor Data Management System extract75 has a buffer overflow that leads to code execution. An overflow in a global variable (sBuffer) leads to a Write-What-Where outcome. Writing beyond sBuffer will clobber most global variables until reaching a pointer such as DES_info or image_info. By controlling that pointer, one achieves an arbitrary write when its fields are assigned. The data written is from a potentially untrusted NITF file in the form of an integer. The attacker can gain control of the instruction pointer
Trust: 1.71
IOT TAXONOMY
| category: | ['embedded device'] | sub_category: | sensor | Trust: 0.1 |
AFFECTED PRODUCTS
| vendor: | airforce | model: | nitf extract utility | scope: | eq | version: | 7.5 | Trust: 1.0 |
| vendor: | air force research laboratory | model: | nitf extract ユーティリティ | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | air force research laboratory | model: | nitf extract ユーティリティ | scope: | eq | version: | nitf extract utility | Trust: 0.8 |
| vendor: | air force research laboratory | model: | nitf extract ユーティリティ | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Classic buffer overflow (CWE-120) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
buffer error
Trust: 0.6
PATCH
| title: | AFRL/RY - COMPASE - Sensor Data Management System | url: | https://www.afrl.af.mil/About-Us/Fact-Sheets/Fact-Sheet-Display/Article/2331781/afrlry-compase-sensor-data-management-system/ | Trust: 0.8 |
| title: | - | url: | https://github.com/khulnasoft-labs/awesome-security | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-13995 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2020-011988 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202009-1568 | Trust: 0.6 |
| db: | OTHER | id: | NONE | Trust: 0.1 |
| db: | VULMON | id: | CVE-2020-13995 | Trust: 0.1 |
REFERENCES
| url: | https://www.riverloopsecurity.com/blog/2020/09/nitf-extract75-cve-2020-13995/ | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-13995 | Trust: 1.4 |
| url: | https://ieeexplore.ieee.org/abstract/document/10769424 | Trust: 0.1 |
| url: | https://cwe.mitre.org/data/definitions/787.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
| url: | https://github.com/khulnasoft-labs/awesome-security | Trust: 0.1 |
SOURCES
| db: | OTHER | id: | - |
| db: | VULMON | id: | CVE-2020-13995 |
| db: | JVNDB | id: | JVNDB-2020-011988 |
| db: | CNNVD | id: | CNNVD-202009-1568 |
| db: | NVD | id: | CVE-2020-13995 |
LAST UPDATE DATE
2025-01-30T19:36:53.664000+00:00
SOURCES UPDATE DATE
| db: | VULMON | id: | CVE-2020-13995 | date: | 2022-05-03T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-011988 | date: | 2021-04-21T06:39:00 |
| db: | CNNVD | id: | CNNVD-202009-1568 | date: | 2022-05-05T00:00:00 |
| db: | NVD | id: | CVE-2020-13995 | date: | 2024-11-21T05:02:18.587 |
SOURCES RELEASE DATE
| db: | VULMON | id: | CVE-2020-13995 | date: | 2020-09-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-011988 | date: | 2021-04-21T00:00:00 |
| db: | CNNVD | id: | CNNVD-202009-1568 | date: | 2020-09-25T00:00:00 |
| db: | NVD | id: | CVE-2020-13995 | date: | 2020-09-25T13:15:12.230 |