Sign-up

ID

VAR-201102-0383


TITLE

7T Interactive Graphical SCADA System Malformed Message Remote Memory Corruption Vulnerability

Trust: 1.0

sources: IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1 // IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-0501

DESCRIPTION

The 7T Interactive Graphical SCADA System is an automated monitoring and control system. An attacker can send a specially crafted message to the 20222 TCP port monitored by the target server, which can trigger a denial of service or arbitrary code execution. An attacker can exploit this issue to execute arbitrary code with administrative privileges. Successfully exploiting this issue will completely comprise the affected system. Failed exploit attempts will result in a denial-of-service condition. ---------------------------------------------------------------------- Get a tax break on purchases of Secunia Solutions! If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at: http://secunia.com/products/corporate/vim/section_179/ ---------------------------------------------------------------------- TITLE: 7-Technologies Interactive Graphical SCADA System ODBC Server Vulnerability SECUNIA ADVISORY ID: SA43359 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/43359/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=43359 RELEASE DATE: 2011-03-05 DISCUSS ADVISORY: http://secunia.com/advisories/43359/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/43359/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=43359 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in 7-Technologies Interactive Graphical SCADA System, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system. Successful exploitation may allow execution of arbitrary code. SOLUTION: Update to the latest version. Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ PROVIDED AND/OR DISCOVERED BY: Jeremy Brown ORIGINAL ADVISORY: http://www.us-cert.gov/control_systems/pdf/ICSA-11-018-02.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.26

sources: CNVD: CNVD-2011-0501 // BID: 46310 // IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1 // IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d // PACKETSTORM: 98946

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.0

sources: IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1 // IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-0501

AFFECTED PRODUCTS

vendor:7model:interactive graphical scada systemscope:eqversion:9

Trust: 1.3

vendor:7model:interactive graphical scada systemscope:eqversion:8

Trust: 0.9

vendor:7model:interactive graphical scada systemscope:eqversion:8*

Trust: 0.4

sources: IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1 // IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-0501 // BID: 46310

CVSS

SEVERITY

CVSSV2

CVSSV3

IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1
value: HIGH

Trust: 0.2

IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d
value: LOW

Trust: 0.2

IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.3 [IVD]

Trust: 0.2

sources: IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1 // IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d

THREAT TYPE

network

Trust: 0.3

sources: BID: 46310

TYPE

Buffer overflow

Trust: 0.4

sources: IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1 // IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d

PATCH

title:7T Interactive Graphical SCADA System Malformed Message Remote Memory Corruption Vulnerability Patchurl:https://www.cnvd.org.cn/patchinfo/show/2847

Trust: 0.6

sources: CNVD: CNVD-2011-0501

EXTERNAL IDS

db:CNVDid:CNVD-2011-0501

Trust: 1.0

db:ICS CERTid:ICSA-11-018-02

Trust: 1.0

db:BIDid:46310

Trust: 0.9

db:IVDid:7D7DA121-463F-11E9-A5A0-000C29342CB1

Trust: 0.2

db:IVDid:E1F9D14C-1F9F-11E6-ABEF-000C29C66E3D

Trust: 0.2

db:SECUNIAid:43359

Trust: 0.2

db:PACKETSTORMid:98946

Trust: 0.1

sources: IVD: 7d7da121-463f-11e9-a5a0-000c29342cb1 // IVD: e1f9d14c-1f9f-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-0501 // BID: 46310 // PACKETSTORM: 98946

REFERENCES

url:http://www.us-cert.gov/control_systems/pdf/icsa-11-018-02.pdf

Trust: 1.0

url:http://www.igss.com/

Trust: 0.3

url:http://secunia.com/products/corporate/evm/

Trust: 0.1

url:http://secunia.com/products/corporate/vim/section_179/

Trust: 0.1

url:http://secunia.com/advisories/43359/#comments

Trust: 0.1

url:https://ca.secunia.com/?page=viewadvisory&vuln_id=43359

Trust: 0.1

url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

Trust: 0.1

url:http://secunia.com/advisories/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/vulnerability_scanning/personal/

Trust: 0.1

url:http://secunia.com/advisories/43359/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/advisories/about_secunia_advisories/

Trust: 0.1

sources: CNVD: CNVD-2011-0501 // BID: 46310 // PACKETSTORM: 98946

CREDITS

Jeremy Brown

Trust: 0.3

sources: BID: 46310

SOURCES

db:IVDid:7d7da121-463f-11e9-a5a0-000c29342cb1
db:IVDid:e1f9d14c-1f9f-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2011-0501
db:BIDid:46310
db:PACKETSTORMid:98946

LAST UPDATE DATE

2022-05-17T01:48:41.091000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2011-0501date:2011-02-11T00:00:00
db:BIDid:46310date:2011-03-23T19:06:00

SOURCES RELEASE DATE

db:IVDid:7d7da121-463f-11e9-a5a0-000c29342cb1date:2011-02-11T00:00:00
db:IVDid:e1f9d14c-1f9f-11e6-abef-000c29c66e3ddate:2011-02-11T00:00:00
db:CNVDid:CNVD-2011-0501date:2011-02-11T00:00:00
db:BIDid:46310date:2011-02-10T00:00:00
db:PACKETSTORMid:98946date:2011-03-05T10:20:44