Lucene search

[email protected]CVE-2019-12261

HistoryAug 09, 2019 - 9:15 p.m.

CVE-2019-12261

2019-08-0921:15:11

CWE-120

[email protected]

web.nvd.nist.gov

221

cve-2019-12261

wind river

vxworks

tcp

buffer overflow

ipnet

security vulnerability

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.065 Low

EPSS

Percentile

93.7%

JSON

Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.

Affected configurations

NVD

Node

windrivervxworksRange6.5–6.9.4.12

windrivervxworksMatch7.0-

Node

sonicwallsonicosRange5.9.0.0–5.9.0.7

sonicwallsonicosRange5.9.1.0.–5.9.1.12

sonicwallsonicosRange6.2.0.0–6.2.3.1

sonicwallsonicosRange6.2.4.0–6.2.4.3

sonicwallsonicosRange6.2.5.0–6.2.5.3

sonicwallsonicosRange6.2.6.0–6.2.6.1

sonicwallsonicosRange6.2.7.0–6.2.7.4

sonicwallsonicosRange6.2.9.0–6.2.9.2

sonicwallsonicosRange6.5.0.0–6.5.0.3

sonicwallsonicosRange6.5.1.0–6.5.1.4

sonicwallsonicosRange6.5.2.0–6.5.2.3

sonicwallsonicosRange6.5.3.0–6.5.3.3

sonicwallsonicosRange6.5.4.0.–6.5.4.3

sonicwallsonicosMatch6.2.7.0

sonicwallsonicosMatch6.2.7.1

sonicwallsonicosMatch6.2.7.7

Node

siemenssiprotec_5_firmwareRange<7.59

AND

siemenssiprotec_5Match-

Node

netappe-series_santricity_os_controllerRange8.00–8.40.50.00

Node

siemenssiprotec_5_firmwareRange<7.91

AND

siemenssiprotec_5Match-

Node

siemenspower_meter_9410_firmwareRange<2.2.1

AND

siemenspower_meter_9410Match-

Node

siemenspower_meter_9810_firmware

AND

siemenspower_meter_9810Match-

Node

siemensruggedcom_win7000_firmwareRange<bs5.2.461.17

AND

siemensruggedcom_win7000Match-

Node

siemensruggedcom_win7018_firmwareRange<bs5.2.461.17

AND

siemensruggedcom_win7018Match-

Node

siemensruggedcom_win7025_firmwareRange<bs5.2.461.17

AND

siemensruggedcom_win7025Match-

Node

siemensruggedcom_win7200_firmwareRange<bs5.2.461.17

AND

siemensruggedcom_win7200Match-

Node

oraclecommunications_eagleRange46.6.0–46.8.2

Node

beldenhirschmann_hiosRange≤07.0.07

AND

beldenhirschmann_ees20Match-

beldenhirschmann_ees25Match-

beldenhirschmann_eesx20Match-

beldenhirschmann_eesx30Match-

beldenhirschmann_grs1020Match-

beldenhirschmann_grs1030Match-

beldenhirschmann_grs1042Match-

beldenhirschmann_grs1120Match-

beldenhirschmann_grs1130Match-

beldenhirschmann_grs1142Match-

beldenhirschmann_msp30Match-

beldenhirschmann_msp32Match-

beldenhirschmann_rail_switch_power_liteMatch-

beldenhirschmann_rail_switch_power_smartMatch-

beldenhirschmann_red25Match-

beldenhirschmann_rsp20Match-

beldenhirschmann_rsp25Match-

beldenhirschmann_rsp30Match-

beldenhirschmann_rsp35Match-

beldenhirschmann_rspe30Match-

beldenhirschmann_rspe32Match-

beldenhirschmann_rspe35Match-

beldenhirschmann_rspe37Match-

Node

beldenhirschmann_hiosRange≤07.5.01

AND

beldenhirschmann_msp40Match-

beldenhirschmann_octopus_os3Match-

Node

beldenhirschmann_hiosRange≤07.2.04

AND

beldenhirschmann_dragon_mach4000Match-

beldenhirschmann_dragon_mach4500Match-

Node

beldenhirschmann_hiosRange≤05.3.06

AND

beldenhirschmann_eagle_oneMatch-

beldenhirschmann_eagle20Match-

beldenhirschmann_eagle30Match-

Node

beldengarrettcom_magnum_dx940e_firmwareRange≤1.0.1_y7

AND

beldengarrettcom_magnum_dx940eMatch-

CPENameOperatorVersion
windriver:vxworkswindriver vxworkslt6.9.4.12
windriver:vxworkswindriver vxworkseq7.0

CPE	Name	Operator	Version
windriver:vxworks	windriver vxworks	lt	6.9.4.12
windriver:vxworks	windriver vxworks	eq	7.0

References

cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf

cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf

cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf

psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009

security.netapp.com/advisory/ntap-20190802-0001/

support.f5.com/csp/article/K41190253

support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12261

support2.windriver.com/index.php?page=security-notices

www.oracle.com/security-alerts/cpuoct2020.html

www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.065 Low

EPSS

Percentile

93.7%

JSON

Related for CVE-2019-12261

nessus7 cvelist1 prion1 nvd1 threatpost1 ics4 thn1 fortinet1 f51 myhack582 oracle1