Juntheworld

**Name of the Vulnerable Software and Affected Versions** NASA Trick version 19.6.0 **Description** A stack-based buffer overflow exists in the TCP Socket Handler component. This issue occurs within the `JSONVariableServerThread::parse request()` function located in the `trick source/sim services/JSONVariableServer/JSONVariableServerThread.cpp` file. A remote attacker can exploit this flaw to cause a buffer overflow, which happens when a program writes more data to a buffer on the stack than it can hold. **Recommendations** As a temporary mitigation, restrict access to the `JSONVariableServerThread::parse request()` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NASA cFS versions prior to 7.0.2 **Description** A buffer overflow exists in the SBN TCP Module within the `OS read()` function located in the `modules/protocol/tcp/fsw/src/sbn tcp if.c` file. This issue occurs when the `MsgSz` argument is manipulated, allowing an attacker on the local network to trigger the overflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NASA cFS versions prior to 7.0.2 **Description** A security flaw exists in the cFE Software Bus component within the `CFE SB GetUserDataLength()` function located in the `src/cFS/cfe/modules/sb/fsw/src/cfe sb util.c` file. A remote attacker can trigger an integer underflow by manipulating the `TotalMsgSize`/`HdrSize` argument. Integer underflow occurs when an arithmetic operation results in a value smaller than the minimum value the variable can hold, often causing it to wrap around to a very large positive number. **Recommendations** As a temporary workaround, restrict access to the `CFE SB GetUserDataLength()` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.