← Volver a CVEs

CVE-2019-12255

CRITICAL

9.8

Descripcion

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado8/9/2019

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

belden:garrettcom_magnum_dx940ebelden:garrettcom_magnum_dx940e_firmwarebelden:hirschmann_dragon_mach4000belden:hirschmann_dragon_mach4500belden:hirschmann_eagle20belden:hirschmann_eagle30belden:hirschmann_eagle_onebelden:hirschmann_ees20belden:hirschmann_ees25belden:hirschmann_eesx20belden:hirschmann_eesx30belden:hirschmann_grs1020belden:hirschmann_grs1030belden:hirschmann_grs1042belden:hirschmann_grs1120belden:hirschmann_grs1130belden:hirschmann_grs1142belden:hirschmann_hiosbelden:hirschmann_msp30belden:hirschmann_msp32belden:hirschmann_msp40belden:hirschmann_octopus_os3belden:hirschmann_rail_switch_power_litebelden:hirschmann_rail_switch_power_smartbelden:hirschmann_red25belden:hirschmann_rsp20belden:hirschmann_rsp25belden:hirschmann_rsp30belden:hirschmann_rsp35belden:hirschmann_rspe30belden:hirschmann_rspe32belden:hirschmann_rspe35belden:hirschmann_rspe37netapp:e-series_santricity_os_controllersiemens:power_meter_9410siemens:power_meter_9410_firmwaresiemens:power_meter_9810siemens:power_meter_9810_firmwaresiemens:ruggedcom_win7000siemens:ruggedcom_win7000_firmwaresiemens:ruggedcom_win7018siemens:ruggedcom_win7018_firmwaresiemens:ruggedcom_win7025siemens:ruggedcom_win7025_firmwaresiemens:ruggedcom_win7200siemens:ruggedcom_win7200_firmwaresiemens:siprotec_5siemens:siprotec_5_firmwaresonicwall:sonicoswindriver:vxworks

Debilidades (CWE)

CWE-120

Referencias

http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html(cve@mitre.org)

https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf(cve@mitre.org)

https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf(cve@mitre.org)

https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf(cve@mitre.org)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009(cve@mitre.org)

https://security.netapp.com/advisory/ntap-20190802-0001/(cve@mitre.org)

https://support.f5.com/csp/article/K41190253(cve@mitre.org)

https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS(cve@mitre.org)

https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255(cve@mitre.org)

https://support2.windriver.com/index.php?page=security-notices(cve@mitre.org)

https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/(cve@mitre.org)

http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html(af854a3a-2127-422b-91ae-364da2661108)

https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf(af854a3a-2127-422b-91ae-364da2661108)

https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf(af854a3a-2127-422b-91ae-364da2661108)

https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf(af854a3a-2127-422b-91ae-364da2661108)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20190802-0001/(af854a3a-2127-422b-91ae-364da2661108)

https://support.f5.com/csp/article/K41190253(af854a3a-2127-422b-91ae-364da2661108)

https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS(af854a3a-2127-422b-91ae-364da2661108)

https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255(af854a3a-2127-422b-91ae-364da2661108)

https://support2.windriver.com/index.php?page=security-notices(af854a3a-2127-422b-91ae-364da2661108)

https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.