High WID-SEC-2023-2884 11 CVEs

Wind River VxWorks: Mehrere Schwachstellen

Published Jul 29, 2019 · Updated Nov 13, 2023 · Revision 5 · de-DE

Vendor: ABB Vendor: Avaya Vendor: Hitachi Energy Vendor: Siemens Vendor: Wind River Systems Vendor: Xerox Product: AFS Product: Hitachi Energy Relion 650 Product: Hitachi Energy Relion 670 Product: Hitachi Energy Relion SAM600-IO Product: Media Gateway Product: Phaser 3635MFP Product: Relion Product: SIPROTEC < 4 7SJ66 V4.41 Product: VxWorks < 7 SR620

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Wind River VxWorks ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.

Product

VxWorks ist ein proprietäres Echtzeitbetriebssystem, das von Wind River Systems entwickelt wird.

Vulnerabilities 11

Unscored —

CVE-2019-12255 Public exploit EPSS 75%

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: T…

Aug 9, 2019
Unscored —

CVE-2019-12256 EPSS 27%

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: S…

Aug 9, 2019
Unscored —

CVE-2019-12257 EPSS 84%

Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulne…

Aug 9, 2019
Unscored —

CVE-2019-12258 Public exploit EPSS 23%

Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: D…

Aug 9, 2019
Unscored —

CVE-2019-12259 EPSS 16%

Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNE…

Aug 9, 2019
Unscored —

CVE-2019-12260 EPSS 23%

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vul…

Aug 9, 2019
Unscored —

CVE-2019-12261

Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET s…

Aug 9, 2019
Unscored —

CVE-2019-12262

Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security v…

Aug 14, 2019
Unscored —

CVE-2019-12263

Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security …

Aug 9, 2019
Unscored —

CVE-2019-12264

Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc …

Aug 5, 2019
Unscored —

CVE-2019-12265 EPSS 60%

Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IP…

Aug 9, 2019

Revision history

2023-11-13 #5
Neue Updates von Siemens aufgenommen
2020-07-15 #4
Neue Updates von ABB aufgenommen
2019-10-29 #3
Neue Updates von Avaya
2019-10-06 #2
Neue Updates von Xerox
2019-07-29 #1
Initiale Fassung

References

Siemens Security Advisory SSA-617233 vom 2023-11-14
https://cert-portal.siemens.com/productcert/html/ssa-617233.html
Wind River Security Advisory vom 2019-07-29
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/security-advisory-ipnet/
Xerox Mini Bulletin XRX19AA vom 2019-10-06
https://security.business.xerox.com/wp-content/uploads/2019/10/cert_Security_Mini_Bulletin_XRX19AA_for_Phaser3635MFP.pdf
Avaya Security Advisory ASA-2019-210 vom 2019-10-29
https://downloads.avaya.com/css/P8/documents/101060489
ABB Cyber Security Advisory 1MRG000001
https://search.abb.com/library/Download.aspx?DocumentID=1MRG000001&LanguageCode=en&DocumentPartId=&Action=Launch
ABB Security Advisory 1MRG037536
https://search.abb.com/library/Download.aspx?DocumentID=1MRG035816&LanguageCode=en&DocumentPartId=&Action=Launch