Sign-up

ID

VAR-201311-0453


TITLE

ABB MicroSCADA 'wserver.exe' Remote code execution vulnerability

Trust: 1.1

sources: IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14746 // BID: 63901

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ABB MicroSCADA Wserver. Authentication is not required to exploit this vulnerability.The specific flaw exists within the wserver.exe component which listens on TCP port 12221. This component user-supplied data directly to a CreateProcessA call. By supplying a UNC path to a controlled binary a remote attacker can execute arbitrary code under the context of the vulnerable process. ABB MicroSCADA wserver.exe The \"CreateProcessA()\" function fails to properly filter the input submitted by the user to the parameter, allowing the remote attacker to exploit the vulnerability to send a specially crafted request to the TCP port 12221 to trigger a stack-based buffer overflow, which can crash the application or Execute arbitrary code in the SYSTEM context. ABB MicroSCADA is a set of substation monitoring software developed by ABB in Switzerland for power transmission and distribution systems. The software includes a human-machine interface (MMI) and flexible application engineering tools, and provides functions such as monitoring, event alarms, and trend graph statistics. There is a code execution vulnerability in ABB MicroSCADA that originates from a program that does not properly filter input submitted by users

Trust: 2.16

sources: ZDI: ZDI-13-270 // CNVD: CNVD-2013-14746 // CNNVD: CNNVD-201311-433 // BID: 63901 // IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14746

AFFECTED PRODUCTS

vendor:abbmodel:microscadascope:eqversion:9.x

Trust: 0.8

vendor:abbmodel:microscadascope: - version: -

Trust: 0.7

sources: IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d // ZDI: ZDI-13-270 // CNVD: CNVD-2013-14746

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: ZDI-13-270
value: HIGH

Trust: 0.7

CNVD: CNVD-2013-14746
value: HIGH

Trust: 0.6

IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

ZDI: ZDI-13-270
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

CNVD: CNVD-2013-14746
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d // ZDI: ZDI-13-270 // CNVD: CNVD-2013-14746

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201311-433

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201311-433

PATCH

title:ABB has issued an update to correct this vulnerability.url:http://www05.abb.com/global/scot/scot229.nsf/veritydisplay/41ccfa8ccd0431e6c1257c1200395574/$file/abb_softwarevulnerabilityhandlingadvisory_abb-vu-psac-1mrs235805.pdf

Trust: 0.7

title:ABB MicroSCADA 'wserver.exe' patch for remote code execution vulnerabilityurl:https://www.cnvd.org.cn/patchinfo/show/41343

Trust: 0.6

sources: ZDI: ZDI-13-270 // CNVD: CNVD-2013-14746

EXTERNAL IDS

db:BIDid:63901

Trust: 1.5

db:ZDIid:ZDI-13-270

Trust: 1.3

db:CNVDid:CNVD-2013-14746

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-1785

Trust: 0.7

db:CNNVDid:CNNVD-201311-433

Trust: 0.6

db:IVDid:5BB49026-1EFB-11E6-ABEF-000C29C66E3D

Trust: 0.2

sources: IVD: 5bb49026-1efb-11e6-abef-000c29c66e3d // ZDI: ZDI-13-270 // CNVD: CNVD-2013-14746 // BID: 63901 // CNNVD: CNNVD-201311-433

REFERENCES

url:http://www05.abb.com/global/scot/scot229.nsf/veritydisplay/41ccfa8ccd0431e6c1257c1200395574/$file/abb_softwarevulnerabilityhandlingadvisory_abb-vu-psac-1mrs235805.pdf

Trust: 0.7

url:http://www.abb.com/global/scot/scot229.nsf/veritydisplay/41ccfa8ccd0431e6c1257c1200395574/

Trust: 0.6

url:http://www.zerodayinitiative.com/advisories/zdi-13-270/

Trust: 0.6

url:http://www.securityfocus.com/bid/63901

Trust: 0.6

url:http://www.abb.com/

Trust: 0.3

sources: ZDI: ZDI-13-270 // CNVD: CNVD-2013-14746 // BID: 63901 // CNNVD: CNNVD-201311-433

CREDITS

Brian Gorenc

Trust: 0.9

sources: BID: 63901 // CNNVD: CNNVD-201311-433

SOURCES

db:IVDid:5bb49026-1efb-11e6-abef-000c29c66e3d
db:ZDIid:ZDI-13-270
db:CNVDid:CNVD-2013-14746
db:BIDid:63901
db:CNNVDid:CNNVD-201311-433

LAST UPDATE DATE

2022-05-17T01:51:11.545000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-13-270date:2013-11-24T00:00:00
db:CNVDid:CNVD-2013-14746date:2013-11-27T00:00:00
db:BIDid:63901date:2013-11-24T00:00:00
db:CNNVDid:CNNVD-201311-433date:2013-12-13T00:00:00

SOURCES RELEASE DATE

db:IVDid:5bb49026-1efb-11e6-abef-000c29c66e3ddate:2013-11-27T00:00:00
db:ZDIid:ZDI-13-270date:2013-11-24T00:00:00
db:CNVDid:CNVD-2013-14746date:2013-11-27T00:00:00
db:BIDid:63901date:2013-11-24T00:00:00
db:CNNVDid:CNNVD-201311-433date:2013-11-24T00:00:00