title: RTI Connext DDS Professional and Connext DDS Secure Stack-based Buffer Overflow
description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code.
problem types: CWE-121 Stack-based Buffer Overflow
affected:
{
product: Connext DDS Professional
vendor: RTI
versions:
lessThanOrEqual: 6.1.0, status: affected, version: 4.2x, versionType: custom
}
{
product: Connext DDS Secure
vendor: RTI
versions:
lessThanOrEqual: 6.1.0, status: affected, version: 4.2x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
]
solutions: RTI recommends users apply the available patches for these issues. A patch is available on the RTI customer portal or by contacting RTI Support. Also, contact RTI Support for mitigations, including how to use RTI DDS Secure to mitigate against the network amplification issue.