CVE-2015-3963
First published: Tue Aug 04 2015(Updated: )
Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Windriver Vxworks | >=6.5<=6.6 | |
| Windriver Vxworks | >=6.7<6.7.1.1 | |
| Windriver Vxworks | >=6.8<6.8.3 | |
| Windriver Vxworks | >=6.9<6.9.4.4 | |
| Windriver Vxworks | =6.6.3 | |
| Windriver Vxworks | =6.6.4 | |
| Windriver Vxworks | =6.6.4.1 | |
| Windriver Vxworks | =7.0 | |
| Schneider-electric Sage 1210 | ||
| Schneider-electric Sage 1230 | ||
| Schneider-electric Sage 1250 | ||
| Schneider-electric Sage 1310 | ||
| Schneider-electric Sage 1330 | ||
| Schneider-electric Sage 1350 | ||
| Schneider-electric Sage 1410 | ||
| Schneider-electric Sage 1430 | ||
| Schneider-electric Sage 1450 | ||
| Schneider-electric Sage 2200 | ||
| Schneider-electric Sage 2400 | ||
| Schneider-electric Sage 3030 | ||
| Schneider-electric Sage 3030 Magnum |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01
- http://www.securityfocus.com/bid/75302
- http://www.securitytracker.com/id/1032730
- http://www.securitytracker.com/id/1033181
- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01
- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A
- https://security.netapp.com/advisory/ntap-20160324-0001/
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/windriver
- canonical/windriver vxworks
- version/windriver vxworks/6.5
- version/windriver vxworks/6.6
- version/windriver vxworks/6.7
- version/windriver vxworks/6.8
- version/windriver vxworks/6.9
- version/windriver vxworks/6.6.3
- version/windriver vxworks/6.6.4
- version/windriver vxworks/6.6.4.1
- version/windriver vxworks/7.0
- vendor/schneider-electric
- canonical/schneider-electric sage 1210
- canonical/schneider-electric sage 1230
- canonical/schneider-electric sage 1250
- canonical/schneider-electric sage 1310
- canonical/schneider-electric sage 1330
- canonical/schneider-electric sage 1350
- canonical/schneider-electric sage 1410
- canonical/schneider-electric sage 1430
- canonical/schneider-electric sage 1450
- canonical/schneider-electric sage 2200
- canonical/schneider-electric sage 2400
- canonical/schneider-electric sage 3030
- canonical/schneider-electric sage 3030 magnum