Sign-up

ID

VAR-201202-0239


CVE

CVE-2012-0224


TITLE

7T TERMIS DLL Load arbitrary code execution vulnerability

Trust: 0.8

sources: IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d // CNVD: CNVD-2012-0764

DESCRIPTION

Untrusted search path vulnerability in 7-Technologies (7T) AQUIS 1.5 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0223. DLL It may be possible to get permission through the file. AQUIS Operation is a software product developed by 7-Technologies of Denmark (7T). Used in hydraulic models, automation engineering, systems engineering and software engineering. 7-Technologies AQUIS software has DLL hijacking problem. The attacker can prevent the malicious DLL from being loaded in the software directory and will be loaded before the legal DLL. The attacker must access the host file system to exploit this vulnerability, and the exploit can be exploited in the application context. Execute arbitrary code. 7-Technologies TERMIS is an energy network simulation platform designed to improve system design and operation. An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. AQUIS 1.5 and prior versions are vulnerable. ---------------------------------------------------------------------- Secunia presentations @ RSA Conference 2012, San Francisco, USA, 27 Feb-02 March Listen to our Chief Security Specialist, Research Analyst Director, and Director Product Management & Quality Assurance discuss the industry's key topics. Also, visit the Secunia stand #817. Find out more: http://www.rsaconference.com/events/2012/usa/index.htm ---------------------------------------------------------------------- TITLE: 7-Technologies AQUIS / TERMIS Insecure Library Loading Vulnerability SECUNIA ADVISORY ID: SA48093 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48093/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48093 RELEASE DATE: 2012-02-20 DISCUSS ADVISORY: http://secunia.com/advisories/48093/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/48093/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=48093 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in AQUIS and TERMIS, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to the application loading unspecified libraries in an insecure manner. This can be exploited to load arbitrary libraries by tricking a user into e.g. opening a certain file located on a remote WebDAV or SMB share. The vulnerability is reported in the following products: * AQUIS version 1.5 dated October 13, 2011 and prior. * TERMIS version 2.10 dated November 30, 2011 and prior. SOLUTION: Apply patches. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute−Information and Communication Security Technology Center (ICST). ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-01.pdf http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-02.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.42

sources: NVD: CVE-2012-0224 // JVNDB: JVNDB-2011-003689 // CNVD: CNVD-2012-0761 // CNVD: CNVD-2012-0764 // BID: 52070 // IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d // IVD: 1b680d10-2354-11e6-abef-000c29c66e3d // PACKETSTORM: 109960

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.6

sources: IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d // IVD: 1b680d10-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-0761 // CNVD: CNVD-2012-0764

AFFECTED PRODUCTS

vendor:7tmodel:aquisscope:lteversion:1.5

Trust: 1.0

vendor:7model:aquisscope:eqversion:1.5

Trust: 0.9

vendor:7model:aquisscope:lteversion:1.5

Trust: 0.8

vendor:7model:termisscope:eqversion:2.10

Trust: 0.6

vendor:7tmodel:aquisscope:eqversion:1.5

Trust: 0.6

vendor:aquismodel: - scope:eqversion:*

Trust: 0.4

sources: IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d // IVD: 1b680d10-2354-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-0761 // CNVD: CNVD-2012-0764 // BID: 52070 // JVNDB: JVNDB-2011-003689 // CNNVD: CNNVD-201202-370 // NVD: CVE-2012-0224

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-0224
value: HIGH

Trust: 1.0

NVD: CVE-2012-0224
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201202-370
value: CRITICAL

Trust: 0.6

IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d
value: CRITICAL

Trust: 0.2

IVD: 1b680d10-2354-11e6-abef-000c29c66e3d
value: CRITICAL

Trust: 0.2

nvd@nist.gov: CVE-2012-0224
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 1b680d10-2354-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d // IVD: 1b680d10-2354-11e6-abef-000c29c66e3d // JVNDB: JVNDB-2011-003689 // CNNVD: CNNVD-201202-370 // NVD: CVE-2012-0224

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2011-003689 // NVD: CVE-2012-0224

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201202-370

TYPE

other

Trust: 1.0

sources: IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d // IVD: 1b680d10-2354-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201202-370

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-003689

PATCH
title:AQUISurl:http://www.7t.dk/products/aquis/index.aspx
Trust: 0.8
title:7T AQUIS DLL loads patches for arbitrary code execution vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/10471
Trust: 0.6
title:7T TERMIS DLL loads patches for arbitrary code execution vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/10472
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-0761 // 
            
            
            
            CNVD: CNVD-2012-0764 // 
            
            
            
            JVNDB: JVNDB-2011-003689

EXTERNAL IDS
db:NVDid:CVE-2012-0224
Trust: 4.3
db:ICS CERTid:ICSA-12-025-01
Trust: 3.4
db:ICS CERTid:ICSA-12-025-02
Trust: 1.3
db:CNNVDid:CNNVD-201202-370
Trust: 1.0
db:CNVDid:CNVD-2012-0764
Trust: 0.8
db:CNVDid:CNVD-2012-0761
Trust: 0.8
db:JVNDBid:JVNDB-2011-003689
Trust: 0.8
db:SECUNIAid:48093
Trust: 0.8
db:BIDid:52070
Trust: 0.3
db:IVDid:300E9400-32EB-47A7-AB9D-04BEFEB7011D
Trust: 0.2
db:IVDid:1B680D10-2354-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:109960
Trust: 0.1
sources:
            
            
            IVD: 300e9400-32eb-47a7-ab9d-04befeb7011d // 
            
            
            
            IVD: 1b680d10-2354-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2012-0761 // 
            
            
            
            CNVD: CNVD-2012-0764 // 
            
            
            
            BID: 52070 // 
            
            
            
            JVNDB: JVNDB-2011-003689 // 
            
            
            
            PACKETSTORM: 109960 // 
            
            
            
            CNNVD: CNNVD-201202-370 // 
            
            
            
            NVD: CVE-2012-0224

REFERENCES
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-025-01.pdf
Trust: 3.4
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-025-02.pdf
Trust: 1.3
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0224
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-0224
Trust: 0.8
url:http://secunia.com/advisories/48093
Trust: 0.6
url:http://www.7t.dk/products/aquis/index.aspx
Trust: 0.3
url:http://secunia.com/advisories/48093/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://www.rsaconference.com/events/2012/usa/index.htm
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/48093/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=48093
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-0761 // 
            
            
            
            CNVD: CNVD-2012-0764 // 
            
            
            
            BID: 52070 // 
            
            
            
            JVNDB: JVNDB-2011-003689 // 
            
            
            
            PACKETSTORM: 109960 // 
            
            
            
            CNNVD: CNNVD-201202-370 // 
            
            
            
            NVD: CVE-2012-0224

CREDITS
Kuang-Chun Hung
Trust: 0.3
sources:
            
            
            BID: 52070

SOURCES
db:IVDid:300e9400-32eb-47a7-ab9d-04befeb7011d
db:IVDid:1b680d10-2354-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2012-0761
db:CNVDid:CNVD-2012-0764
db:BIDid:52070
db:JVNDBid:JVNDB-2011-003689
db:PACKETSTORMid:109960
db:CNNVDid:CNNVD-201202-370
db:NVDid:CVE-2012-0224

LAST UPDATE DATE
2025-04-11T22:56:18.772000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-0761date:2012-02-21T00:00:00
db:CNVDid:CNVD-2012-0764date:2012-02-21T00:00:00
db:BIDid:52070date:2012-02-17T00:00:00
db:JVNDBid:JVNDB-2011-003689date:2012-04-20T00:00:00
db:CNNVDid:CNNVD-201202-370date:2012-02-22T00:00:00
db:NVDid:CVE-2012-0224date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:300e9400-32eb-47a7-ab9d-04befeb7011ddate:2012-02-21T00:00:00
db:IVDid:1b680d10-2354-11e6-abef-000c29c66e3ddate:2012-02-21T00:00:00
db:CNVDid:CNVD-2012-0761date:2012-02-21T00:00:00
db:CNVDid:CNVD-2012-0764date:2012-02-21T00:00:00
db:BIDid:52070date:2012-02-17T00:00:00
db:JVNDBid:JVNDB-2011-003689date:2012-02-23T00:00:00
db:PACKETSTORMid:109960date:2012-02-20T06:42:07
db:CNNVDid:CNNVD-201202-370date:2012-02-22T00:00:00
db:NVDid:CVE-2012-0224date:2012-02-21T13:31:35.907