PT-2019-4726 · Wind River · Vxworks

Published 2019-07-29 · Updated 2022-08-16 · CVE-2019-12256

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wind River VxWorks versions 6.9 through vx7

Description The issue is related to a buffer overflow in the IPv4 component, specifically a stack overflow when parsing IPv4 packets' IP options. This can be exploited by a remote attacker to execute arbitrary code by sending specially crafted IPv4 packets.

Recommendations For Wind River VxWorks versions 6.9 through vx7, consider disabling the IPv4 component or restricting its use until a patch is available to prevent exploitation of the buffer overflow vulnerability.

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-120

Related Identifiers

BDU:2020-01276

CVE-2019-12256

Affected Products

Vxworks

References · 15

• https://windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12256 · Vendor Advisory
• https://support2.windriver.com/index.php?page=security-notices · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01276 · Security Note
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12256 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf · Note
• https://t.me/cvenotify/26599 · Telegram Post
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12256 · Note
• https://security.netapp.com/advisory/ntap-20190802-0001 · Note
• https://support.f5.com/csp/article/K41190253 · Note
• https://belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf · Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf · Note