Sign-up

ID

VAR-201302-0261


CVE

CVE-2013-0658


TITLE

Schneider Electric Accutech Manager Heap Buffer Overflow Vulnerability

Trust: 1.1

sources: IVD: 1758de30-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-00998 // BID: 57651

DESCRIPTION

Heap-based buffer overflow in RFManagerService.exe in Schneider Electric Accutech Manager 2.00.1 and earlier allows remote attackers to execute arbitrary code via a crafted HTTP request. Schneider Electric Accutech Manager is a real-time monitoring and management software based on windows services. Accutech Manager is prone to a remote heap-based buffer-overflow vulnerability. Failed exploit attempts will result in a denial-of-service condition. Accutech Manager 2.00.1 and prior are vulnerable. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Schneider Electric Accutech Manager Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA52034 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52034/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52034 RELEASE DATE: 2013-01-31 DISCUSS ADVISORY: http://secunia.com/advisories/52034/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/52034/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=52034 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Schneider Electric Accutech Manager, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to an unspecified error and can be exploited to cause a heap-based buffer overflow. Successful exploitation may allow execution of arbitrary code. The vulnerability is reported in versions 2.00.1 and prior. SOLUTION: No official solution is currently available. A fix is scheduled to be released in February 2013. PROVIDED AND/OR DISCOVERED BY: The vendor credits Exodus Intelligence. ORIGINAL ADVISORY: http://www.schneider-electric.com/sites/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2013/01/20130121_advisory_of_vulnerability_affecting_accutech_manager_software.xml OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.33

sources: NVD: CVE-2013-0658 // JVNDB: JVNDB-2013-001583 // CNVD: CNVD-2013-00998 // CNVD: CNVD-2013-00694 // BID: 57651 // IVD: 1758de30-2353-11e6-abef-000c29c66e3d // VULHUB: VHN-60660 // PACKETSTORM: 119975

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.4

sources: IVD: 1758de30-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-00998 // CNVD: CNVD-2013-00694

AFFECTED PRODUCTS

vendor:schneider electricmodel:accutech managerscope:lteversion:2.00.1

Trust: 1.8

vendor:schneidermodel:electric accutech managerscope:lteversion:<=2.00.1

Trust: 0.6

vendor:schneidermodel:electric accutech managerscope:eqversion:2.x

Trust: 0.6

vendor:schneider electricmodel:accutech managerscope:eqversion:2.00.1

Trust: 0.6

vendor:accutech managermodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 1758de30-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-00998 // CNVD: CNVD-2013-00694 // JVNDB: JVNDB-2013-001583 // CNNVD: CNNVD-201302-267 // NVD: CVE-2013-0658

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-0658
value: HIGH

Trust: 1.0

NVD: CVE-2013-0658
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201302-267
value: CRITICAL

Trust: 0.6

IVD: 1758de30-2353-11e6-abef-000c29c66e3d
value: CRITICAL

Trust: 0.2

VULHUB: VHN-60660
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-0658
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: 1758de30-2353-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-60660
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 1758de30-2353-11e6-abef-000c29c66e3d // VULHUB: VHN-60660 // JVNDB: JVNDB-2013-001583 // CNNVD: CNNVD-201302-267 // NVD: CVE-2013-0658

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-60660 // JVNDB: JVNDB-2013-001583 // NVD: CVE-2013-0658

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201302-267

TYPE

Buffer overflow

Trust: 0.8

sources: IVD: 1758de30-2353-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201302-267

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-001583

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-60660

PATCH
title:Top Pageurl:http://www.schneider-electric.com/
Trust: 0.8
title:サポートurl:http://www.schneider-electric.co.jp/sites/japan/jp/support/contact/we-care.page
Trust: 0.8
title:トップページurl:http://www.schneider-electric.com/site/home/index.cfm/jp/
Trust: 0.8
title:Patch for Schneider Electric Accutech Manager heap buffer overflow vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/31879
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-00998 // 
            
            
            
            JVNDB: JVNDB-2013-001583

EXTERNAL IDS
db:NVDid:CVE-2013-0658
Trust: 4.2
db:ICS CERTid:ICSA-13-043-01
Trust: 3.1
db:CNNVDid:CNNVD-201302-267
Trust: 0.9
db:CNVDid:CNVD-2013-00998
Trust: 0.8
db:JVNDBid:JVNDB-2013-001583
Trust: 0.8
db:SECUNIAid:52034
Trust: 0.7
db:CNVDid:CNVD-2013-00694
Trust: 0.6
db:BIDid:57651
Trust: 0.4
db:IVDid:1758DE30-2353-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:EXPLOIT-DBid:24474
Trust: 0.1
db:SEEBUGid:SSVID-78192
Trust: 0.1
db:VULHUBid:VHN-60660
Trust: 0.1
db:PACKETSTORMid:119975
Trust: 0.1
sources:
            
            
            IVD: 1758de30-2353-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2013-00998 // 
            
            
            
            CNVD: CNVD-2013-00694 // 
            
            
            
            VULHUB: VHN-60660 // 
            
            
            
            BID: 57651 // 
            
            
            
            JVNDB: JVNDB-2013-001583 // 
            
            
            
            PACKETSTORM: 119975 // 
            
            
            
            CNNVD: CNNVD-201302-267 // 
            
            
            
            NVD: CVE-2013-0658

REFERENCES
url:http://ics-cert.us-cert.gov/pdf/icsa-13-043-01.pdf
Trust: 3.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0658
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0658
Trust: 0.8
url:http://secunia.com/advisories/52034/http
Trust: 0.6
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
url:http://www.schneider-electric.com/sites/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/content/news/data/en/local/cybersecurity/general_information/2013/01/20130121_advisory_of_vulnerability_affecting_accutech_manager_software.xml
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/52034/#comments
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=52034
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://secunia.com/advisories/52034/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-00998 // 
            
            
            
            CNVD: CNVD-2013-00694 // 
            
            
            
            VULHUB: VHN-60660 // 
            
            
            
            BID: 57651 // 
            
            
            
            JVNDB: JVNDB-2013-001583 // 
            
            
            
            PACKETSTORM: 119975 // 
            
            
            
            CNNVD: CNNVD-201302-267 // 
            
            
            
            NVD: CVE-2013-0658

CREDITS
Exodus Intelligence
Trust: 0.3
sources:
            
            
            BID: 57651

SOURCES
db:IVDid:1758de30-2353-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-00998
db:CNVDid:CNVD-2013-00694
db:VULHUBid:VHN-60660
db:BIDid:57651
db:JVNDBid:JVNDB-2013-001583
db:PACKETSTORMid:119975
db:CNNVDid:CNNVD-201302-267
db:NVDid:CVE-2013-0658

LAST UPDATE DATE
2025-04-11T23:20:36.159000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-00998date:2017-04-20T00:00:00
db:CNVDid:CNVD-2013-00694date:2017-04-20T00:00:00
db:VULHUBid:VHN-60660date:2013-02-19T00:00:00
db:BIDid:57651date:2013-05-13T05:12:00
db:JVNDBid:JVNDB-2013-001583date:2013-02-18T00:00:00
db:CNNVDid:CNNVD-201302-267date:2013-02-20T00:00:00
db:NVDid:CVE-2013-0658date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:1758de30-2353-11e6-abef-000c29c66e3ddate:2013-02-19T00:00:00
db:CNVDid:CNVD-2013-00998date:2013-02-19T00:00:00
db:CNVDid:CNVD-2013-00694date:2013-02-04T00:00:00
db:VULHUBid:VHN-60660date:2013-02-15T00:00:00
db:BIDid:57651date:2013-01-21T00:00:00
db:JVNDBid:JVNDB-2013-001583date:2013-02-18T00:00:00
db:PACKETSTORMid:119975date:2013-01-31T09:27:35
db:CNNVDid:CNNVD-201302-267date:2013-02-20T00:00:00
db:NVDid:CVE-2013-0658date:2013-02-15T12:09:27.897