Lucene search

[email protected]CVE-2019-12257

HistoryAug 09, 2019 - 6:15 p.m.

CVE-2019-12257

2019-08-0918:15:11

CWE-120

[email protected]

web.nvd.nist.gov

106

cve-2019-12257

wind river

vxworks

dhcp

buffer overflow

ipnet

security vulnerability

heap overflow

nvd

5.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.93 High

EPSS

Percentile

99.1%

JSON

Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.

Affected configurations

NVD

Node

windrivervxworksRange6.5–6.9.4

Node

sonicwallsonicosRange5.9.0.0–5.9.0.7

sonicwallsonicosRange5.9.1.0.–5.9.1.12

sonicwallsonicosRange6.2.0.0–6.2.3.1

sonicwallsonicosRange6.2.4.0–6.2.4.3

sonicwallsonicosRange6.2.5.0–6.2.5.3

sonicwallsonicosRange6.2.6.0–6.2.6.1

sonicwallsonicosRange6.2.7.0–6.2.7.4

sonicwallsonicosRange6.2.9.0–6.2.9.2

sonicwallsonicosRange6.5.0.0–6.5.0.3

sonicwallsonicosRange6.5.1.0–6.5.1.4

sonicwallsonicosRange6.5.2.0–6.5.2.3

sonicwallsonicosRange6.5.3.0–6.5.3.3

sonicwallsonicosRange6.5.4.0.–6.5.4.3

sonicwallsonicosMatch6.2.7.0

sonicwallsonicosMatch6.2.7.1

sonicwallsonicosMatch6.2.7.7

Node

siemenssiprotec_5Match-

AND

siemenssiprotec_5_firmwareRange<7.59

Node

netappe-series_santricity_os_controllerRange8.00–8.40.50.00

Node

siemenssiprotec_5Match-

AND

siemenssiprotec_5_firmwareRange<7.91

Node

siemensruggedcom_win7000Match-

AND

siemensruggedcom_win7000_firmwareRange<bs5.2.461.17

Node

siemensruggedcom_win7018Match-

AND

siemensruggedcom_win7018_firmwareRange<bs5.2.461.17

Node

siemensruggedcom_win7025_firmwareRange<bs5.2.461.17

AND

siemensruggedcom_win7025Match-

Node

siemensruggedcom_win7200_firmwareRange<bs5.2.461.17

AND

siemensruggedcom_win7200Match-

Node

beldenhirschmann_hiosRange≤07.0.07

AND

beldenhirschmann_ees20Match-

beldenhirschmann_ees25Match-

beldenhirschmann_eesx20Match-

beldenhirschmann_eesx30Match-

beldenhirschmann_grs1020Match-

beldenhirschmann_grs1030Match-

beldenhirschmann_grs1042Match-

beldenhirschmann_grs1120Match-

beldenhirschmann_grs1130Match-

beldenhirschmann_grs1142Match-

beldenhirschmann_msp30Match-

beldenhirschmann_msp32Match-

beldenhirschmann_rail_switch_power_liteMatch-

beldenhirschmann_rail_switch_power_smartMatch-

beldenhirschmann_red25Match-

beldenhirschmann_rsp20Match-

beldenhirschmann_rsp25Match-

beldenhirschmann_rsp30Match-

beldenhirschmann_rsp35Match-

beldenhirschmann_rspe30Match-

beldenhirschmann_rspe32Match-

beldenhirschmann_rspe35Match-

beldenhirschmann_rspe37Match-

Node

beldenhirschmann_hiosRange≤07.5.01

AND

beldenhirschmann_msp40Match-

beldenhirschmann_octopus_os3Match-

Node

beldenhirschmann_hiosRange≤07.2.04

AND

beldenhirschmann_dragon_mach4000Match-

beldenhirschmann_dragon_mach4500Match-

Node

beldenhirschmann_hiosRange≤05.3.06

AND

beldenhirschmann_eagle_oneMatch-

beldenhirschmann_eagle20Match-

beldenhirschmann_eagle30Match-

Node

beldengarrettcom_magnum_dx940e_firmwareRange≤1.0.1_y7

AND

beldengarrettcom_magnum_dx940eMatch-

CPENameOperatorVersion
windriver:vxworkswindriver vxworkslt6.9.4

CPE	Name	Operator	Version
windriver:vxworks	windriver vxworks	lt	6.9.4

References

cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf

cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf

psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009

security.netapp.com/advisory/ntap-20190802-0001/

support.f5.com/csp/article/K41190253

support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12257

support2.windriver.com/index.php?page=security-notices

www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/

Social References

5.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.93 High

EPSS

Percentile

99.1%

JSON

Related for CVE-2019-12257

prion1 nessus8 nvd1 cvelist1 threatpost1 fortinet1 thn1 ics3 myhack582 f51