Wind River VxWorks Integer Overflow Vulnerability (CNVD-2015-08443)

Wind River VxWorks A suite of real-time operating systems for the Internet of Things. An integer overflow vulnerability exists in Wind River VxWorks, which could be exploited by a remote attacker to submit a specific request to crash an application or execute arbitrary code...

CVE-2008-2476

The IPv6 Neighbor Discovery Protocol NDP implementation in 1 FreeBSD 6.3 through 7.1, 2 OpenBSD 4.2 and 4.3, 3 NetBSD, 4 Force10 FTOS before E7.7.1.1, 5 Juniper JUNOS, and 6 Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attacke...

Wind River VxWorks Integer Overflow Vulnerability

VxWorks is a real-time operating system widely used on ICS-related devices. An integer overflow vulnerability exists in the implementation of Wind River VxWorks versions 5.5-6.9.4.1. Successful exploitation could allow an attacker to remotely execute arbitrary code in the operating system, corrup...

Huawei UAP2105 Command Injection Vulnerability

The Huawei UAP2105 is a home-based WCDMA wireless network access device. The Huawei UAP2105 suffers from a command injection vulnerability that allows local attackers to execute VxWorks debugging commands via a serial port access shell to view and modify memory and files, resulting in information...

Security Advisory - No Authentication Vulnerability on the Serial Port of the UAP2105

The UAP2105 serves as a radio access device in the uBro solutions. As one of the AP series products developed on the basis of 3GPP R99/R4/R5/R6 FDD, the UAP2105 complies with the R8 HNB standard and provides Small Office and Home Office SOHO and home users with improved indoor coverage. With the...

CVE-2015-3963

Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnetcoreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number ISN values, which...

Code injection

Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnetcoreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number ISN values, which...

CVE-2015-3963

Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnetcoreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number ISN values, which...

CVE-2015-3963

CVE-2015-3963 describes a TCP initial sequence number (ISN) predictability vulnerability in Wind River VxWorks (various versions, including 5.x–7.x as deployed by Schneider Electric SAGE RTUs). The root cause is generation of predictable TCP ISNs, enabling remote attackers to spoof or disrupt TCP...

CVE-2015-3963: Use of Insufficiently Random Values

Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnetcoreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number ISN values, which...

Wind River VxWorks TCP Predictability Vulnerability

According to its self-reported version, the Wind River VxWorks remote device is potentially affected by a TCP predictability vulnerability that allows a man-in-the-middle attacker to predict the TCP initial sequence numbers based on previous values. This can exploited to spoof or disrupt TCP...

TCP Vulnerability Haunts Wind River VxWorks Embedded OS

There is a TCP prediction vulnerability in Wind River’s widely deployed VxWorks embedded software that can enable an attacker to disrupt or spoof the TCP connections to and from target devices. VxWorks is an embedded operating system that’s used in a large number of ICS products that are deployed...

Wind River VXWorks TCP Predictable Vulnerability

VxWorks is a real-time operating system widely used on ICS-related devices. VxWorks software generates predictable initial TCP sequential numbers that can be predicted by an attacker based on previous values to spoof or interrupt TCP connections...

Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-15-169-01A Wind River VxWorks TCP Predictability Vulnerability in ICS Devices that was published November 5, 2015, on the NCCIC/ICS-CERT web site. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a...

Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-15-169-01A Wind River VxWorks TCP Predictability Vulnerability in ICS Devices that was published November 5, 2015, on the NCCIC/ICS-CERT web site. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a...

Network Time Protocol Vulnerabilities (Supplement Update A)

OVERVIEW --------- Begin Update A Part 1 of 2 -------- This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-353-01C Network Time Protocol Vulnerabilities that was published February 5, 2015, on the ICS‑CERT web site. --------- End Update A Part 1 of 2 ----------...

VxWorks WDB Agent 远程内存读取漏洞

VxWorks安全初探 404@KnownSec --- 0x00 前言 --- 关于VxWorks，这里引用44CON议题《攻击 VxWorks：从石器时代到星际》探究 一文章中的介绍： VxWorks 是世界上使用最广泛的一种在嵌入式系统中部署的实时操作系统，是由美国WindRiver公司（简称风河公司，即WRS 公司）于1983年设计开发的。其市场范围跨越所有的安全关键领域，仅举几例，包括火星好奇心流浪者、波音787梦幻客机、网络路由器。这些应用程序的安全高危性质使得VxWorks的安全被高度关注。 VxWorks操作系统是由美国Wind...

Multiple Routers (IRC Request) Disconnect Denial of Service Vulnerability

No description provided by source. It appears that various routers are prone to an IRC-only DoS attack. Particularly Netgear and Linksys routers have been shown vulnerable. If a client behind one of the vulnerable routers connects to an IRC server on port 6667 and only 6667, does not DoS with oth...

Schneider Electric PLC ETY Series Ethernet Controller - Denial of Service

No description provided by source. Telnet server of Schenider Electric ETY Series Controllers have a security problem. We noticed that while we are connected to the PLC through telnet, if we call telnet instance inside VxWorks again it can cause the device to crash. The telnet instance name is...

Tru64 Malformed TCP Packet Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4011/info It has been reported that Tru64 systems may be prone to a denial of service condition when handling malformed TCP packets. Specifically, when processing a malformed TCP packet with both the SYN and FIN flags set...