Details of VAR-201208-0351

ID

VAR-201208-0351

CVE

CVE-2012-3024

TITLE

Tridium Niagara AX Framework Vulnerabilities that bypass authentication

Trust: 0.8

sources: JVNDB: JVNDB-2012-003721

DESCRIPTION

Tridium Niagara AX Framework through 3.6 uses predictable values for (1) session IDs and (2) keys, which might allow remote attackers to bypass authentication via a brute-force attack. Niagara Framework is prone to a session-hijacking vulnerability. Successful exploit of this issue allows an attacker to gain unauthorized access to the affected application. ---------------------------------------------------------------------- The new Secunia CSI 6.0 is now available in beta! Seamless integration with your existing security solutions Sign-up to become a Beta tester: http://secunia.com/csi6beta ---------------------------------------------------------------------- TITLE: Niagara Framework Predictable Session Identifier Vulnerability SECUNIA ADVISORY ID: SA50288 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50288/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50288 RELEASE DATE: 2012-08-16 DISCUSS ADVISORY: http://secunia.com/advisories/50288/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/50288/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=50288 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Niagara Framework, which can be exploited by malicious people to hijack a user's session. The vulnerability is caused due to predictable sessions identifiers being used. SOLUTION: No official solution is currently available. PROVIDED AND/OR DISCOVERED BY: Billy Rios and Terry McCorkle via ICS-CERT. ORIGINAL ADVISORY: ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-12-228-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2012-3024 // JVNDB: JVNDB-2012-003721 // CNVD: CNVD-2012-8347 // BID: 55042 // IVD: 80e047f8-2353-11e6-abef-000c29c66e3d // VULHUB: VHN-56305 // PACKETSTORM: 115613

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 80e047f8-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-8347

AFFECTED PRODUCTS

vendor:	tridium	model:	niagara ax	scope:	lte	version:	3.6	Trust: 1.0
vendor:	tridium	model:	niagara ax framework	scope:	lte	version:	3.6	Trust: 0.8
vendor:	tridium	model:	niagara ax	scope:	eq	version:	3.5/3.6/3.7	Trust: 0.6
vendor:	tridium	model:	niagra ax framework	scope:	eq	version:	3.5	Trust: 0.6
vendor:	tridium	model:	niagra ax framework	scope:	eq	version:	3.6	Trust: 0.6
vendor:	niagra ax framework	model:	-	scope:	eq	version:	3.5	Trust: 0.2
vendor:	niagra ax framework	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 80e047f8-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-8347 // JVNDB: JVNDB-2012-003721 // CNNVD: CNNVD-201208-276 // NVD: CVE-2012-3024

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-3024
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-3024
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2012-8347
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201208-276
value:	MEDIUM
Trust: 0.6
IVD:	80e047f8-2353-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2
VULHUB:	VHN-56305
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-3024
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2012-8347
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	80e047f8-2353-11e6-abef-000c29c66e3d
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-56305
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: IVD: 80e047f8-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-8347 // VULHUB: VHN-56305 // JVNDB: JVNDB-2012-003721 // CNNVD: CNNVD-201208-276 // NVD: CVE-2012-3024

PROBLEMTYPE DATA

problemtype:

CWE-287

Trust: 1.9

sources: VULHUB: VHN-56305 // JVNDB: JVNDB-2012-003721 // NVD: CVE-2012-3024

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201208-276

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201208-276

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-003721

PATCH

title:	Security Update: Niagara AX 3.5 and 3.6 Security Patches	url:	http://www.tridium.com/cs/tridium_news/security_patch_36	Trust: 0.8
title:	Patch for the Tridium Niagara AX Framework Licensing Issue Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/35532	Trust: 0.6
title:	framework-3.6.0	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=44160	Trust: 0.6

sources: CNVD: CNVD-2012-8347 // JVNDB: JVNDB-2012-003721 // CNNVD: CNNVD-201208-276

EXTERNAL IDS

db:	NVD	id:	CVE-2012-3024	Trust: 3.7
db:	ICS CERT	id:	ICSA-12-228-01	Trust: 3.2
db:	BID	id:	55042	Trust: 1.0
db:	CNNVD	id:	CNNVD-201208-276	Trust: 0.9
db:	CNVD	id:	CNVD-2012-8347	Trust: 0.8
db:	JVNDB	id:	JVNDB-2012-003721	Trust: 0.8
db:	IVD	id:	80E047F8-2353-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	SECUNIA	id:	50288	Trust: 0.2
db:	VULHUB	id:	VHN-56305	Trust: 0.1
db:	PACKETSTORM	id:	115639	Trust: 0.1
db:	PACKETSTORM	id:	115613	Trust: 0.1

sources: IVD: 80e047f8-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-8347 // VULHUB: VHN-56305 // BID: 55042 // JVNDB: JVNDB-2012-003721 // PACKETSTORM: 115639 // PACKETSTORM: 115613 // CNNVD: CNNVD-201208-276 // NVD: CVE-2012-3024

REFERENCES

url:	http://www.us-cert.gov/control_systems/pdf/icsa-12-228-01.pdf	Trust: 3.2
url:	http://www.tridium.com/cs/tridium_news/security_patch_36	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3024	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-3024	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2012-4028	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2012-3025	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2012-3024	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2012-4027	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=50288	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/advisories/50288/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://secunia.com/csi6beta	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/50288/#comments	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: CNVD: CNVD-2012-8347 // VULHUB: VHN-56305 // JVNDB: JVNDB-2012-003721 // PACKETSTORM: 115639 // PACKETSTORM: 115613 // CNNVD: CNNVD-201208-276 // NVD: CVE-2012-3024

CREDITS

Billy Rios and Terry McCorkle

Trust: 0.3

sources: BID: 55042

SOURCES

db:	IVD	id:	80e047f8-2353-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2012-8347
db:	VULHUB	id:	VHN-56305
db:	BID	id:	55042
db:	JVNDB	id:	JVNDB-2012-003721
db:	PACKETSTORM	id:	115639
db:	PACKETSTORM	id:	115613
db:	CNNVD	id:	CNNVD-201208-276
db:	NVD	id:	CVE-2012-3024

LAST UPDATE DATE

2025-04-11T22:53:41.532000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2012-8347	date:	2012-08-20T00:00:00
db:	VULHUB	id:	VHN-56305	date:	2012-08-16T00:00:00
db:	BID	id:	55042	date:	2013-08-13T05:26:00
db:	JVNDB	id:	JVNDB-2012-003721	date:	2012-08-20T00:00:00
db:	CNNVD	id:	CNNVD-201208-276	date:	2023-03-23T00:00:00
db:	NVD	id:	CVE-2012-3024	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	IVD	id:	80e047f8-2353-11e6-abef-000c29c66e3d	date:	2012-08-20T00:00:00
db:	CNVD	id:	CNVD-2012-8347	date:	2012-08-20T00:00:00
db:	VULHUB	id:	VHN-56305	date:	2012-08-16T00:00:00
db:	BID	id:	55042	date:	2012-08-16T00:00:00
db:	JVNDB	id:	JVNDB-2012-003721	date:	2012-08-20T00:00:00
db:	PACKETSTORM	id:	115639	date:	2012-08-17T03:33:48
db:	PACKETSTORM	id:	115613	date:	2012-08-16T06:34:56
db:	CNNVD	id:	CNNVD-201208-276	date:	2012-08-20T00:00:00
db:	NVD	id:	CVE-2012-3024	date:	2012-08-16T10:38:04.593