VDB
CNVD-2019-25699
CNVD-2019-25699
PUBLISHED
Wind River Systems VxWorks是美国风河系统（Wind River Systems）公司的一套嵌入式实时操作系统（RTOS）。 Wind River Systems VxWorks 7版本和6.9版本中对IPv4数据包IP选项的解析存在缓冲区溢出漏洞。攻击者可利用该漏洞借助带有无效选项的IPv4数据包造成tNet0任务崩溃，执行代码。
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wind River Systems Wind River Systems VxWorks 6.9 | ||
| Wind River Systems Wind River Systems VxWorks 6.6 | ||
| Wind River Systems Wind River Systems VxWorks 6.7 | ||
| Wind River Systems Wind River Systems VxWorks 6.8 |
Timeline
- Jul 29, 2019 CVE ID Reserved
- Aug 2, 2019 CVE Published
References
- https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/security-advisory-ipnet/security-advisory-ipnet.pdf url
- https://www.tenable.com/blog/critical-vulnerabilities-dubbed-urgent11-place-devices-running-vxworks-at-risk-of-rce-attacks url
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12256 url
- CVE-2019-12256 url