Vulnerability-Lookup

BDU:2020-01290 (CVE-2019-12259)

Vulnerability from fstec – Published: 2020-04-06 – Updated: 2020-04-06 – View on bdu.fstec.ru Fixed

Title

Уязвимость протокола IGMPv3 операционных систем реального времени Wind River VxWorks, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость протокола IGMPv3 операционных систем реального времени Wind River VxWorks связана с ошибкой индекса массива. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании путем переименования «NULL» в IGMP

Severity

5.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-362 - Одновременное выполнение с использованием общего ресурса с неправильной синхронизацией («Ситуация гонки»)

Aliases

CVE-2019-12259, BSECV-2019-05

References

6 references

URL
https://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulleti…
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
https://security.netapp.com/advisory/ntap-20190802-0001/
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12259
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/

Impacted products

7 products from 5 vendors

Vendors

Belden Inc., Siemens AG, Red Lion Controls, Inc., Wind River Systems

Products

Hirschmann HiOS, GarrettCom DX, RUGGEDCOM WIN70xxb Base Station, SIPROTEC 5 CPU CP300, SIPROTEC 5 CPU CP100, VxWorks, RUGGEDCOM WIN72xx Base Station

Versions

RSP до 07.0.08 включительно (Hirschmann HiOS), RSPE до 07.0.08 включительно (Hirschmann HiOS), RSPS до 07.0.08 включительно (Hirschmann HiOS), RSPL до 07.0.08 включительно (Hirschmann HiOS), MSP до 07.0.08 включительно (Hirschmann HiOS), EES до 07.0.08 включительно (Hirschmann HiOS), EESX до 07.0.08 включительно (Hirschmann HiOS), GRS до 07.0.08 включительно (Hirschmann HiOS), OS до 07.0.08 включительно (Hirschmann HiOS), RES до 07.0.08 включительно (Hirschmann HiOS), MSP40 до 07.5.02 включительно (Hirschmann HiOS), OS3 до 07.5.02 включительно (Hirschmann HiOS), RSPE TSN до 08.0.01 включительно (Hirschmann HiOS), DRAGON MACH 4x00 до 07.2.05 включительно (Hirschmann HiOS), EAGLE до 05.3.07 включительно (Hirschmann HiOS), EAGLE One до 05.3.07 включительно (Hirschmann HiOS), DX940e до 1.0.2 Y2 включительно (GarrettCom DX), до BS5.2.461.17 включительно (RUGGEDCOM WIN70xxb Base Station), до 8.01 включительно (SIPROTEC 5 CPU CP300), до 8.01 включительно (SIPROTEC 5 CPU CP100), от 6.9 до 6.9.4.12 включительно (VxWorks), 7 2.1.0.0 (VxWorks), 7 1.4.3.1 (VxWorks), до BS5.2.461.17 включительно (RUGGEDCOM WIN72xx Base Station)

Product types

Operating system, Network device, Network appliance software, Средство АСУ ТП, ПО программно-аппаратного средства АСУ ТП

Platforms

Belden Inc. Hirschmann HiOS RSP до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RSPE до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RSPS до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RSPL до 07.0.08 включительно, Belden Inc. Hirschmann HiOS MSP до 07.0.08 включительно, Belden Inc. Hirschmann HiOS EES до 07.0.08 включительно, Belden Inc. Hirschmann HiOS EESX до 07.0.08 включительно, Belden Inc. Hirschmann HiOS GRS до 07.0.08 включительно, Belden Inc. Hirschmann HiOS OS до 07.0.08 включительно, Belden Inc. Hirschmann HiOS RES до 07.0.08 включительно, Belden Inc. Hirschmann HiOS MSP40 до 07.5.02 включительно, Belden Inc. Hirschmann HiOS OS3 до 07.5.02 включительно, Belden Inc. Hirschmann HiOS RSPE TSN до 08.0.01 включительно, Belden Inc. Hirschmann HiOS DRAGON MACH 4x00 до 07.2.05 включительно, Belden Inc. Hirschmann HiOS EAGLE до 05.3.07 включительно, Belden Inc. Hirschmann HiOS EAGLE One до 05.3.07 включительно, Belden Inc. GarrettCom DX DX940e до 1.0.2 Y2 включительно, Siemens AG RUGGEDCOM WIN70xxb Base Station до BS5.2.461.17 включительно, Red Lion Controls, Inc. SIPROTEC 5 CPU CP300 до 8.01 включительно, Inc. SIPROTEC 5 CPU CP100 до 8.01 включительно, Wind River Systems, Inc. VxWorks от 6.9 до 6.9.4.12 включительно, Inc. VxWorks 7 2.1.0.0, Inc. VxWorks 7 1.4.3.1, Siemens AG RUGGEDCOM WIN72xx Base Station до BS5.2.461.17 включительно

Mitigations

Использование рекомендаций Для Hirschmann: https://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en Для Siemens: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf Для Wind River: https://support.f5.com/csp/article/K41190253 https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12256 Для NetApp: Следовать рекомендациям производителя https://security.netapp.com/advisory/ntap-20190802-0001/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Belden Inc., Siemens AG, Red Lion Controls, Inc., Wind River Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "RSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPE \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPL \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), MSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EESX \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), GRS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), OS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), MSP40 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), OS3 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), RSPE TSN \u0434\u043e 08.0.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), DRAGON MACH 4x00 \u0434\u043e 07.2.05 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EAGLE \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), EAGLE One \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Hirschmann HiOS), DX940e \u0434\u043e 1.0.2 Y2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (GarrettCom DX), \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (RUGGEDCOM WIN70xxb Base Station), \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SIPROTEC 5 CPU CP300), \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SIPROTEC 5 CPU CP100), \u043e\u0442 6.9 \u0434\u043e 6.9.4.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (VxWorks), 7 2.1.0.0 (VxWorks), 7 1.4.3.1 (VxWorks), \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (RUGGEDCOM WIN72xx Base Station)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439\n\n\u0414\u043b\u044f Hirschmann:\nhttps://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en\n\n\u0414\u043b\u044f Siemens:\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf\n\n\u0414\u043b\u044f Wind River:\nhttps://support.f5.com/csp/article/K41190253\nhttps://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12256\n\n\u0414\u043b\u044f NetApp: \n\u0421\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f https://security.netapp.com/advisory/ntap-20190802-0001/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.08.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "06.04.2020",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "06.04.2020",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2020-01290",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-12259, BSECV-2019-05",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Hirschmann HiOS, GarrettCom DX, RUGGEDCOM WIN70xxb Base Station, SIPROTEC 5 CPU CP300, SIPROTEC 5 CPU CP100, VxWorks, RUGGEDCOM WIN72xx Base Station",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Belden Inc. Hirschmann HiOS RSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPE \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPL \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS MSP \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EESX \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS GRS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS OS \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RES \u0434\u043e 07.0.08 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS MSP40 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS OS3 \u0434\u043e 07.5.02 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS RSPE TSN \u0434\u043e 08.0.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS DRAGON MACH 4x00 \u0434\u043e 07.2.05 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EAGLE \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. Hirschmann HiOS EAGLE One \u0434\u043e 05.3.07 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Belden Inc. GarrettCom DX DX940e \u0434\u043e 1.0.2 Y2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Siemens AG RUGGEDCOM WIN70xxb Base Station \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Red Lion Controls, Inc. SIPROTEC 5 CPU CP300 \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Red Lion Controls, Inc. SIPROTEC 5 CPU CP100 \u0434\u043e 8.01 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Wind River Systems, Inc. VxWorks \u043e\u0442 6.9 \u0434\u043e 6.9.4.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Wind River Systems, Inc. VxWorks 7 2.1.0.0 , Wind River Systems, Inc. VxWorks 7 1.4.3.1 , Siemens AG RUGGEDCOM WIN72xx Base Station \u0434\u043e BS5.2.461.17 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IGMPv3 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 Wind River VxWorks, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043e\u0431\u0449\u0435\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 (\u00ab\u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0433\u043e\u043d\u043a\u0438\u00bb) (CWE-362)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IGMPv3 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 Wind River VxWorks \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0438\u043d\u0434\u0435\u043a\u0441\u0430 \u043c\u0430\u0441\u0441\u0438\u0432\u0430.  \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u043f\u0443\u0442\u0435\u043c \u043f\u0435\u0440\u0435\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u044f \u00abNULL\u00bb \u0432 IGMP",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2019-05_1v3.pdf?hsLang=en\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf\nhttps://security.netapp.com/advisory/ntap-20190802-0001/\nhttps://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12259\nhttps://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-362",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2019-12259 (GCVE-0-2019-12259)

Vulnerability from cvelistv5 – Published: 2019-08-09 18:05 – Updated: 2024-08-04 23:17

Summary

Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

9 references

URL	Tags
https://support2.windriver.com/index.php?page=sec…	x_refsource_MISC
https://psirt.global.sonicwall.com/vuln-detail/SN…	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2019080…	x_refsource_CONFIRM
https://www.windriver.com/security/announcements/…	x_refsource_CONFIRM
https://support2.windriver.com/index.php?page=cve…	x_refsource_CONFIRM
https://support.f5.com/csp/article/K41190253	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:17:39.112Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support2.windriver.com/index.php?page=security-notices"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190802-0001/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12259"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K41190253"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-12T12:06:19.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support2.windriver.com/index.php?page=security-notices"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190802-0001/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12259"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K41190253"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12259",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support2.windriver.com/index.php?page=security-notices",
              "refsource": "MISC",
              "url": "https://support2.windriver.com/index.php?page=security-notices"
            },
            {
              "name": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009",
              "refsource": "CONFIRM",
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190802-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190802-0001/"
            },
            {
              "name": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/",
              "refsource": "CONFIRM",
              "url": "https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/"
            },
            {
              "name": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12259",
              "refsource": "CONFIRM",
              "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2019-12259"
            },
            {
              "name": "https://support.f5.com/csp/article/K41190253",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K41190253"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12259",
    "datePublished": "2019-08-09T18:05:16.000Z",
    "dateReserved": "2019-05-21T00:00:00.000Z",
    "dateUpdated": "2024-08-04T23:17:39.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.