Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| https://support2.windriver.com/index.php?page=security-notices | issue tracking vendor advisory |
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 | third party advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf | third party advisory |
| https://security.netapp.com/advisory/ntap-20190802-0001/ | third party advisory |
| https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/ | vendor advisory |
| https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12257 | vendor advisory |
| https://support.f5.com/csp/article/K41190253 | third party advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf | third party advisory |