Hello, welcome to the Tuesday, July 30th, 2019 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich.

And then I'm recording from Boston, Massachusetts. Security Company Armis released a report

with details regarding 11 vulnerabilities in the VXVWorkx IP stack. Of course, I have to spend a

little bit time on these vulnerabilities here today, in particular, and of course, TCP IP,

sort of one of my favorite topics teaching again this week here in Boston, our intrusion

detection in depth class. And actually, these vulnerabilities are hitting on some of the points that we are covering in the class.

VXWorks is a real-time operating system, so it's very popular with devices industrial control systems and such,

where timing is important. Unlike Linux,XVWorks is a closed-source

operating system, so it is something that vendors that want to use this operating system

actually have to pay money for. Now, it comes with a TCPIP stack that's also known as IPNet.

It's actually unlike in most other operating systems, a somewhat optional component, but

of course not sure how many devices running VXVWorks can really do without IPNet.

The flaws being discovered here by Armis, first of all, have been patched as of about last week,

but they fall into a couple of different categories.

For example, there are some issues that are dealing with the parsing and handling of IPV4 options.

Just earlier, I told students in class that IPV4 options is something you

really shouldn't see anymore in modern networks. IPB4 options pretty much are being

blocked by some routers or at least ignored. But nevertheless, in this case it's the

record route option that's causing issues. Record route can be used in order

to discover routers along the path of a packet. It will essentially instruct routers to add

their IP address to the packet as part of the IP options. And in this case, well, a parsing error will actually lead to a buffer

overflow and can even be leveraged for remote code execution. Similarly, there are also issues

...