PT-2019-4737 · Wind River · Vxworks

Publicado 2019-08-09 · Atualizado 2022-08-12 · CVE-2019-12258

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wind River VxWorks versions 6.6 through 7

Description The issue is related to errors in forming TCP options in the TCP component, which can lead to a denial of service (DoS) of TCP connections via malformed TCP options. This can be exploited by a remote attacker to cause a service disruption.

Recommendations For versions 6.6 through 7, consider disabling the TCP component or restricting its use until a patch is available to prevent exploitation of the session fixation vulnerability.

Exploit

Correção

Race Condition

Session Fixation

Enumeração de Fraquezas

CWE-362

CWE-384

Identificadores relacionados

BDU:2020-01289

CVE-2019-12258

Produtos afetados

Vxworks

Referências · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/vxworks/urgent11_check.rb · Exploit
• https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf · Nota
• https://osv.dev/vulnerability/CVE-2019-12258 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20190802-0001 · Nota
• https://windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11 · Aviso do Fabricante
• https://support.f5.com/csp/article/K41190253 · Nota
• https://bdu.fstec.ru/vul/2020-01289 · Nota de Segurança
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12258 · Aviso do Fabricante
• https://support2.windriver.com/index.php?page=security-notices · Aviso do Fabricante
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12258 · Nota
• https://belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en · Nota
• https://t.me/cvenotify/26601 · Publicação no Telegram
• https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12258 · Nota de Segurança
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 · Nota