Moderate
CVE-2019-12256 - VxWorks IPv4 Options Buffer Overflow
CVE-2019-12256 - VxWorks IPv4 Options Buffer Overflow
Description
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
Add Assessment
Technical Analysis
Capability problems with exploitation: an attacker needs a payload to do something other than a DoS. Shellcode for embedded OSes like this needs to be customized for each firmware version and device, which causes problems. This significantly increases the cost for an attacker to do something other than a DoS since it has to be customized to the target. High utility for an advanced actor who has the capability to develop custom payloads and a particular target in mind. Low utility for a low-skilled actor who wants to ‘spray and pray’.
Mitigations: folks should limit opportunities by having strong malformed-packet filtering at the network level. Routers and switches should not be based on VxWorks at the edge.
https://www.blackhat.com/presentations/bh-usa-09/LINDNER/BHUSA09-Lindner-RouterExploit-SLIDES.pdf
Another interesting issue with this vulnerability lies around getting the malformed packets from the edge of a network into the core of the target device. Each device needs independent analysis to determine the risk. An edge device would be riskier than a core, one. In this particular case, it’s really surprising however that VxWorks did not just isic, which has been around for years and years to find a vulnerability like this: http://isic.sourceforge.net/
Note: when validating the Urgent/11 scanner here: https://github.com/ArmisSecurity/urgent11-detector we found that it was unlikely to be effective across even a minimal security boundary of a standard router between network segments. We had a hard time testing it since the malformed packets were discarded by several commodity and not specially-configured kit.
Technical Analysis
Simply sending a malformed packet can result in RCE on a device running VxWorks, and there are reportedly no features such as ASLR, DEP, etc. enabled to mitigate the issue. Given the simplicity of successful exploitation, I’d say that this is a vulnerability to take seriously and patch.
Any of the others stand out? https://www.armis.com/urgent11/
CVSS V3 Severity and Metrics
General Information
Vendors
- belden,
- netapp,
- siemens,
- sonicwall,
- windriver
Products
- e-series santricity os controller,
- garrettcom magnum dx940e firmware,
- hirschmann hios,
- power meter 9410 firmware,
- power meter 9810 firmware,
- ruggedcom win7000 firmware,
- ruggedcom win7018 firmware,
- ruggedcom win7025 firmware,
- ruggedcom win7200 firmware,
- siprotec 5 firmware,
- sonicos,
- sonicos 6.2.7.0,
- sonicos 6.2.7.1,
- sonicos 6.2.7.7,
- vxworks
References
Miscellaneous
