Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.

An attacker can either hijack an existing TCP-session and inject bad TCP-segments or establish a new TCP-session on any TCP-port listened to by the target. 

This vulnerability could lead to a buffer overflow of up to a full TCP receive-window (by default, 10k-64k depending on version). The buffer overflow occurs in the task calling recv()/recvfrom()/recvmsg(). 

Applications that pass a buffer equal to or larger than a full TCP-window are not susceptible to this attack. Applications passing a stack-allocated variable as a buffer are the easiest to exploit. 

The most likely outcome is a crash of the application reading from the affected socket, which could result in remote code execution.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Wind River is the provider of a real time operating system called VxWorks which is used in the embedded software of the PM 877 Controller. Wind River has announced security vulnerabilities in the VxWorks TCP/IP stack (IPnet) and management of memory block size (Bad Alloc).
The controller PM 877 is affected by vulnerabilities in the TCP/IP stack but it is not affected by the vulnerabilities related to memory management (Bad Alloc). All the associated vulnerabilities which impacted the PM 877 have been corrected. An attacker who successfully exploits these vulnerabilities could hijack existing TCP sessions to inject malformed packets or steal authenticated user session identifiers, resulting in corruptions of data, unauthorized disclosure of information, denial of service and data communications outage or even code execution. The vulnerabilities do not target any ABB products specifically, but potentially affect products that use the operating system.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability:
TCP Urgent Pointer = 0 that leads to an integer underflow.  

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

The version of VxWorks installed on the remote host is 6.x, prior to 6.9.4, and is affected by multiple vulnerabilities :

 - A specially crafted TCP-segment with the URG-flag set may cause overflow of the buffer passed to recv(), recvfrom() or recvmsg() socket routines. (CVE-2019-12255)
 - A specially crafted IPv4 packet, containing invalid encoded SSRR/LSRR options, may cause call-stack overflow. No specific services beyond IPv4 protocol support is required. (CVE-2019-12257)

According to its self-reported version, the remote Xerox WorkCentre is  affected by multiple remote code execution and denial-of-service vulnerabilities in the IPnet TCP/IP stack. An unauthenticated, remote, attacker could leverage these vulnerabilities to gain full access to the affected device or to cause the device to become unresponsive.

According to its self-reported version, the remote device is potentially affected by multiple Wind River VxWorks remote code execution and denial-of-service vulnerabilities in the IPnet TCP/IP stack. An unauthenticated, remote, attacker could leverage these vulnerabilities to gain full access to the affected device or to cause the device to become unresponsive.

Note that Nessus has not checked for the presence of the patch so this finding may be a false positive.

According to its self-reported version, the remote SonicWall firewall is running a version of SonicOS that is affected by multiple vulnerabilities:

  - Stack overflow in the parsing of IPv4 packets IP options. (CVE-2019-12256)

  - TCP Urgent Pointer = 0 leads to integer underflow (CVE-2019-12255)

  - TCP Urgent Pointer state confusion caused by malformed TCP AO option (CVE-2019-12260)

  - TCP Urgent Pointer state confusion during connect to a remote host (CVE-2019-12261)

  - TCP Urgent Pointer state confusion due to race condition (CVE-2019-12263)

  - Heap overflow in DHCP Offer/ACK parsing in ipdhcpc (CVE-2019-12257)

  - TCP connection DoS via malformed TCP options (CVE-2019-12258)

  - Handling of unsolicited Reverse ARP replies (Logical Flaw) (CVE-2019-12262)

  - Logical flaw in IPv4 assignment by the ipdhcpc DHCP client (CVE-2019-12264)

  - DoS via NULL dereference in IGMP parsing (CVE-2019-12259)

  - IGMP Information leak via IGMPv3 specific membership report (CVE-2019-12265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
502262	Hirschmann HiOS Switches Integer Underflow (CVE-2019-12255)	Tenable OT Security	Tenable.ot	critical
501133	ABB Integer Underflow in Wind River VxWorks (CVE-2019-12255)	Tenable OT Security	Tenable.ot	critical
500065	Siemens Integer Underflow in Wind River VxWorks (CVE-2019-12255)	Tenable OT Security	Tenable.ot	critical
701084	VxWorks 6.x < 6.9.4 Multiple Vulnerabilities (URGENT/11)	Nessus Network Monitor	IoT	critical
127109	Xerox WorkCentre Multiple Vulnerabilities (XRX19-016) (URGENT/11)	Nessus	Misc.	critical
127108	Wind River VxWorks Multiple Vulnerabilities (URGENT/11)	Nessus	Misc.	critical
127107	SonicWall SonicOS Firewall Multiple Management Vulnerabilities (URGENT/11)	Nessus	Firewalls	critical

Detections

Analytics

CVE-2019-12255

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical