PT-2015-6362 · Wind River · Vxworks

David Formby + 2 · Published 2015-08-04 · Updated 2021-07-22 · CVE-2015-3963

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wind River VxWorks versions prior to 5.5.1 Wind River VxWorks versions 6.5.x through 6.7.x before 6.7.1.1 Wind River VxWorks versions 6.8.x before 6.8.3 Wind River VxWorks versions 6.9.x before 6.9.4.4 Wind River VxWorks versions 7.x before 7

Description The issue is related to the improper generation of TCP initial sequence number (ISN) values, making it easier for remote attackers to spoof TCP sessions by predicting an ISN value.

Recommendations For versions prior to 5.5.1, update to version 5.5.1 or later. For versions 6.5.x through 6.7.x, update to version 6.7.1.1 or later. For versions 6.8.x, update to version 6.8.3 or later. For versions 6.9.x, update to version 6.9.4.4 or later. For versions 7.x, update to a version later than 7.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2015-3963

Affected Products

Vxworks

References · 8

• http://schneider-electric.com/ww/en/download/document/SEVD-2015-162-01 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-3963 · Security Note
• https://security.netapp.com/advisory/ntap-20160324-0001 · Note
• http://securitytracker.com/id/1032730 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01 · Note
• http://securityfocus.com/bid/75302 · Note
• http://securitytracker.com/id/1033181 · Note