SB2019052918 - Integer overflow in VxWorks
Published: May 29, 2019 Updated: August 8, 2020
Security Bulletin ID
SB2019052918
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Integer overflow (CVE-ID: CVE-2019-9865)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
When RPC is enabled in Wind River VxWorks 6.9 prior to 6.9.1, a specially crafted RPC request can trigger an integer overflow leading to an out-of-bounds memory copy. It may allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code.
Remediation
Install update from vendor's website.