Wind River VxWorks Multiple Vulnerabilities (URGENT/11)

High Nessus Plugin ID 127108

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.7

Synopsis

The remote VxWorks device is potentially affected by multiple remote code execution and denial-of-service vulnerabilities.

Description

According to its self-reported version, the remote device is potentially affected by multiple Wind River VxWorks remote code execution and denial-of-service vulnerabilities in the IPnet TCP/IP stack. An unauthenticated, remote, attacker could leverage these vulnerabilities to gain full access to the affected device or to cause the device to become unresponsive.

Note that Nessus has not checked for the presence of the patch so this finding may be a false positive.

Solution

Contact the device vendor to obtain the appropriate update

See Also

http://www.nessus.org/u?e848e239

http://www.nessus.org/u?e1994faf

https://armis.com/urgent11/

Plugin Details

Severity: High

ID: 127108

File Name: vxworks_urgent11.nasl

Version: 1.4

Type: remote

Family: Misc.

Published: 2019/07/29

Updated: 2019/10/18

Dependencies: 11936

Configuration: Enable paranoid mode

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS Score Source: CVE-2019-12262

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:windriver:vxworks

Required KB Items: Settings/ParanoidReport, Host/OS

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2019/07/29

Vulnerability Publication Date: 2019/07/29

Reference Information

CVE: CVE-2019-12255, CVE-2019-12256, CVE-2019-12257, CVE-2019-12258, CVE-2019-12259, CVE-2019-12260, CVE-2019-12261, CVE-2019-12262, CVE-2019-12263, CVE-2019-12264, CVE-2019-12265

IAVA: 2019-A-0274