Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.

DHCP packets may go past the local area network (LAN) via DHCP-relays, but are otherwise confined to the LAN. 

The DHCP-client may be used by VxWorks and in the bootrom. Bootrom, using DHCP/BOOTP, is only vulnerable during the boot-process. 

This vulnerability may be used to overwrite the heap, which could result in a later crash when a task requests memory from the heap. This vulnerability can result in remote code execution.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Wind River is the provider of a real time operating system called VxWorks which is used in the embedded software of the PM 877 Controller. Wind River has announced security vulnerabilities in the VxWorks TCP/IP stack (IPnet) and management of memory block size (Bad Alloc).
The controller PM 877 is affected by vulnerabilities in the TCP/IP stack but it is not affected by the vulnerabilities related to memory management (Bad Alloc). All the associated vulnerabilities which impacted the PM 877 have been corrected. An attacker who successfully exploits these vulnerabilities could hijack existing TCP sessions to inject malformed packets or steal authenticated user session identifiers, resulting in corruptions of data, unauthorized disclosure of information, denial of service and data communications outage or even code execution. The vulnerabilities do not target any ABB products specifically, but potentially affect products that use the operating system.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The version of VxWorks installed on the remote host is 6.x, prior to 6.9.4, and is affected by multiple vulnerabilities :

 - A specially crafted TCP-segment with the URG-flag set may cause overflow of the buffer passed to recv(), recvfrom() or recvmsg() socket routines. (CVE-2019-12255)
 - A specially crafted IPv4 packet, containing invalid encoded SSRR/LSRR options, may cause call-stack overflow. No specific services beyond IPv4 protocol support is required. (CVE-2019-12257)

According to its self-reported version, the remote Xerox WorkCentre is  affected by multiple remote code execution and denial-of-service vulnerabilities in the IPnet TCP/IP stack. An unauthenticated, remote, attacker could leverage these vulnerabilities to gain full access to the affected device or to cause the device to become unresponsive.

According to its self-reported version, the remote device is potentially affected by multiple Wind River VxWorks remote code execution and denial-of-service vulnerabilities in the IPnet TCP/IP stack. An unauthenticated, remote, attacker could leverage these vulnerabilities to gain full access to the affected device or to cause the device to become unresponsive.

Note that Nessus has not checked for the presence of the patch so this finding may be a false positive.

According to its self-reported version, the remote SonicWall firewall is running a version of SonicOS that is affected by multiple vulnerabilities:

  - Stack overflow in the parsing of IPv4 packets IP options. (CVE-2019-12256)

  - TCP Urgent Pointer = 0 leads to integer underflow (CVE-2019-12255)

  - TCP Urgent Pointer state confusion caused by malformed TCP AO option (CVE-2019-12260)

  - TCP Urgent Pointer state confusion during connect to a remote host (CVE-2019-12261)

  - TCP Urgent Pointer state confusion due to race condition (CVE-2019-12263)

  - Heap overflow in DHCP Offer/ACK parsing in ipdhcpc (CVE-2019-12257)

  - TCP connection DoS via malformed TCP options (CVE-2019-12258)

  - Handling of unsolicited Reverse ARP replies (Logical Flaw) (CVE-2019-12262)

  - Logical flaw in IPv4 assignment by the ipdhcpc DHCP client (CVE-2019-12264)

  - DoS via NULL dereference in IGMP parsing (CVE-2019-12259)

  - IGMP Information leak via IGMPv3 specific membership report (CVE-2019-12265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
502271	Hirschmann HiOS Switches Heap-based Buffer Overflow (CVE-2019-12257)	Tenable OT Security	Tenable.ot	Remote	high
501127	ABB Heap-Based Buffer Overflow in Wind River VxWorks (CVE-2019-12257)	Tenable OT Security	Tenable.ot	Remote	high
701084	VxWorks 6.x < 6.9.4 Multiple Vulnerabilities (URGENT/11)	Nessus Network Monitor	IoT		critical
127109	Xerox WorkCentre Multiple Vulnerabilities (XRX19-016) (URGENT/11)	Nessus	Misc.	Remote	critical
127108	Wind River VxWorks Multiple Vulnerabilities (URGENT/11)	Nessus	Misc.	Remote	critical
127107	SonicWall SonicOS Firewall Multiple Management Vulnerabilities (URGENT/11)	Nessus	Firewalls	Remote	critical

Detections

Analytics

CVE-2019-12257

high

Tenable Plugins

high

high

critical

critical

critical

critical