PT-2019-4736 · Wind River · Vxworks

Published 2019-08-09 · Updated 2022-08-12 · CVE-2019-12263

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wind River VxWorks versions 6.9.4 through vx7

Description The issue is related to a TCP protocol vulnerability in Wind River VxWorks real-time operating systems, specifically concerning errors in the TCP Urgent Pointer state when a shared resource is used, leading to a race condition. This can be exploited by a remote attacker to execute arbitrary code by sending specially crafted TCP packets. The vulnerability involves a buffer overflow in the TCP component and an IPNET security issue due to TCP Urgent Pointer state confusion.

Recommendations For Wind River VxWorks versions 6.9.4 through vx7, update to a version that includes a fix for the TCP Urgent Pointer state confusion issue to prevent exploitation. As a temporary workaround, consider restricting access to the TCP component to minimize the risk of exploitation.

Fix

Race Condition

Memory Corruption

Weakness Enumeration

CWE-362

CWE-787

Related Identifiers

BDU:2020-01288

CVE-2019-12263

Affected Products

Vxworks

References · 15

• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12263 · Vendor Advisory
• https://windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01288 · Security Note
• https://support2.windriver.com/index.php?page=security-notices · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12263 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12263 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf · Note
• https://security.netapp.com/advisory/ntap-20190802-0001 · Note
• https://support.f5.com/csp/article/K41190253 · Note
• https://t.me/cvenotify/26606 · Telegram Post
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12263 · Note
• https://belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf · Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf · Note