Vulnerability-Lookup

BDU:2020-01289 (CVE-2019-12258)

Vulnerability from fstec – Published: 2020-04-06 – Updated: 2020-04-06 – View on bdu.fstec.ru Fixed

Title

Уязвимость протокола TCP операционных систем реального времени Wind River VxWorks, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость протокола TCP операционных систем реального времени Wind River VxWorks связана с ошибками формирования опции TCP. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Severity

5.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:P

5.3 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-362 - Одновременное выполнение с использованием общего ресурса с неправильной синхронизацией («Ситуация гонки»)

Aliases

CVE-2019-12258, BSECV-2019-05

References

6 references

URL
https://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulleti…
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
https://security.netapp.com/advisory/ntap-20190802-0001/
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12258
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/

Impacted products

7 products from 5 vendors

Vendors

Belden Inc., Siemens AG, Red Lion Controls, Inc., Wind River Systems

Products

Hirschmann HiOS, GarrettCom DX, RUGGEDCOM WIN70xxb Base Station, SIPROTEC 5 CPU CP300, SIPROTEC 5 CPU CP100, VxWorks, RUGGEDCOM WIN72xx Base Station

Versions

RSP до 07.0.08 включительно (Hirschmann HiOS), RSPE до 07.0.08 включительно (Hirschmann HiOS), RSPS до 07.0.08 включительно (Hirschmann HiOS), RSPL до 07.0.08 включительно (Hirschmann HiOS), MSP до 07.0.08 включительно (Hirschmann HiOS), EES до 07.0.08 включительно (Hirschmann HiOS), EESX до 07.0.08 включительно (Hirschmann HiOS), GRS до 07.0.08 включительно (Hirschmann HiOS), OS до 07.0.08 включительно (Hirschmann HiOS), RES до 07.0.08 включительно (Hirschmann HiOS), MSP40 до 07.5.02 включительно (Hirschmann HiOS), OS3 до 07.5.02 включительно (Hirschmann HiOS), RSPE TSN до 08.0.01 включительно (Hirschmann HiOS), DRAGON MACH 4x00 до 07.2.05 включительно (Hirschmann HiOS), EAGLE до 05.3.07 включительно (Hirschmann HiOS), EAGLE One до 05.3.07 включительно (Hirschmann HiOS), DX940e до 1.0.2 Y2 включительно (GarrettCom DX), до BS5.2.461.17 включительно (RUGGEDCOM WIN70xxb Base Station), до 8.01 включительно (SIPROTEC 5 CPU CP300), до 8.01 включительно (SIPROTEC 5 CPU CP100), от 6.9 до 6.9.4.12 включительно (VxWorks), 7 2.1.0.0 (VxWorks), 7 1.4.3.1 (VxWorks), до BS5.2.461.17 включительно (RUGGEDCOM WIN72xx Base Station)

Product types

Operating system, Network device, Network appliance software, Средство АСУ ТП, ПО программно-аппаратного средства АСУ ТП

Platforms

Belden Inc. Hirschmann HiOS RSP до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RSPE до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RSPS до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RSPL до 07.0.08 включительно, Belden Inc. Hirschmann HiOS MSP до 07.0.08 включительно, Belden Inc. Hirschmann HiOS EES до 07.0.08 включительно, Belden Inc. Hirschmann HiOS EESX до 07.0.08 включительно, Belden Inc. Hirschmann HiOS GRS до 07.0.08 включительно, Belden Inc. Hirschmann HiOS OS до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RES до 07.0.08 включительно, Belden Inc. Hirschmann HiOS MSP40 до 07.5.02 включительно, Belden Inc. Hirschmann HiOS OS3 до 07.5.02 включительно, Belden Inc. Hirschmann HiOS RSPE TSN до 08.0.01 включительно, Belden Inc. Hirschmann HiOS DRAGON MACH 4x00 до 07.2.05 включительно, Belden Inc. Hirschmann HiOS EAGLE до 05.3.07 включительно, Belden Inc. Hirschmann HiOS EAGLE One до 05.3.07 включительно, Belden Inc. GarrettCom DX DX940e до 1.0.2 Y2 включительно, Siemens AG RUGGEDCOM WIN70xxb Base Station до BS5.2.461.17 включительно, Red Lion Controls, Inc. SIPROTEC 5 CPU CP300 до 8.01 включительно, Inc. SIPROTEC 5 CPU CP100 до 8.01 включительно, Wind River Systems, Inc. VxWorks от 6.9 до 6.9.4.12 включительно, Inc. VxWorks 7 2.1.0.0, Inc. VxWorks 7 1.4.3.1, Siemens AG RUGGEDCOM WIN72xx Base Station до BS5.2.461.17 включительно

Mitigations

Использование рекомендаций Для Hirschmann: https://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en Для Siemens: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf Для Wind River: https://support.f5.com/csp/article/K41190253 https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12256 Для NetApp: https://security.netapp.com/advisory/ntap-20190802-0001/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Belden Inc., Siemens AG, Red Lion Controls, Inc., Wind River Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "RSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPE \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPL \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), MSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EESX \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), GRS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), OS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), MSP40 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), OS3 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPE TSN \u0434\u043e 08.0.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), DRAGON MACH 4x00 \u0434\u043e 07.2.05 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EAGLE \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EAGLE One \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), DX940e \u0434\u043e 1.0.2 Y2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (GarrettCom DX), \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (RUGGEDCOM WIN70xxb Base Station), \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SIPROTEC 5 CPU CP300), \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SIPROTEC 5 CPU CP100), \u043e\u0442 6.9 \u0434\u043e 6.9.4.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (VxWorks), 7 2.1.0.0 (VxWorks), 7 1.4.3.1 (VxWorks), \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (RUGGEDCOM WIN72xx Base Station)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439\n\u0414\u043b\u044f Hirschmann:\nhttps://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en\n\n\u0414\u043b\u044f Siemens:\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf\n\n\u0414\u043b\u044f Wind River:\nhttps://support.f5.com/csp/article/K41190253\nhttps://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12256\n\n\u0414\u043b\u044f NetApp: \nhttps://security.netapp.com/advisory/ntap-20190802-0001/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.08.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "06.04.2020",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "06.04.2020",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2020-01289",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-12258, BSECV-2019-05",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Hirschmann HiOS, GarrettCom DX, RUGGEDCOM WIN70xxb Base Station, SIPROTEC 5 CPU CP300, SIPROTEC 5 CPU CP100, VxWorks, RUGGEDCOM WIN72xx Base Station",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Belden Inc. Hirschmann HiOS RSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPE \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPL \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS MSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EESX \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS GRS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS OS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS MSP40 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS OS3 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPE TSN \u0434\u043e 08.0.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS DRAGON MACH 4x00 \u0434\u043e 07.2.05 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EAGLE \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EAGLE One \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. GarrettCom DX DX940e \u0434\u043e 1.0.2 Y2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Siemens AG RUGGEDCOM WIN70xxb Base Station \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Red Lion Controls, Inc. SIPROTEC 5 CPU CP300 \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Red Lion Controls, Inc. SIPROTEC 5 CPU CP100 \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Wind River Systems, Inc. VxWorks \u043e\u0442 6.9 \u0434\u043e 6.9.4.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Wind River Systems, Inc. VxWorks 7 2.1.0.0 , Wind River Systems, Inc. VxWorks 7 1.4.3.1 , Siemens AG RUGGEDCOM WIN72xx Base Station \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 TCP \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 Wind River VxWorks, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043e\u0431\u0449\u0435\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 (\u00ab\u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0433\u043e\u043d\u043a\u0438\u00bb) (CWE-362)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 TCP \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 Wind River VxWorks \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u043f\u0446\u0438\u0438 TCP.  \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf\nhttps://security.netapp.com/advisory/ntap-20190802-0001/\nhttps://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12258\nhttps://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-362",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,3)"
}

CVE-2019-12258 (GCVE-0-2019-12258)

Vulnerability from cvelistv5 – Published: 2019-08-09 20:00 – Updated: 2024-08-04 23:17

Summary

Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

9 references

URL	Tags
https://support2.windriver.com/index.php?page=sec…	x_refsource_MISC
https://psirt.global.sonicwall.com/vuln-detail/SN…	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019080…	x_refsource_CONFIRM
https://www.windriver.com/security/announcements/…	x_refsource_CONFIRM
https://support2.windriver.com/index.php?page=cve…	x_refsource_MISC
https://support.f5.com/csp/article/K41190253	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:17:38.957Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support2.windriver.com/index.php?page=security-notices"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190802-0001/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12258"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K41190253"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-12T12:06:16.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support2.windriver.com/index.php?page=security-notices"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190802-0001/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12258"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K41190253"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12258",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support2.windriver.com/index.php?page=security-notices",
              "refsource": "MISC",
              "url": "https://support2.windriver.com/index.php?page=security-notices"
            },
            {
              "name": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009",
              "refsource": "CONFIRM",
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190802-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190802-0001/"
            },
            {
              "name": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/",
              "refsource": "CONFIRM",
              "url": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/"
            },
            {
              "name": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12258",
              "refsource": "MISC",
              "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12258"
            },
            {
              "name": "https://support.f5.com/csp/article/K41190253",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K41190253"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12258",
    "datePublished": "2019-08-09T20:00:44.000Z",
    "dateReserved": "2019-05-21T00:00:00.000Z",
    "dateUpdated": "2024-08-04T23:17:38.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.