Sign-up

ID

VAR-201412-0412


CVE

CVE-2014-9192


TITLE

Trihedral VTScada Malformed Request Denial of Service Vulnerability

Trust: 0.8

sources: IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-08874

DESCRIPTION

Integer overflow in Trihedral Engineering VTScada (formerly VTS) 6.5 through 9.x before 9.1.20, 10.x before 10.2.22, and 11.x before 11.1.07 allows remote attackers to cause a denial of service (server crash) via a crafted request, which triggers a large memory allocation. Authentication is not required to exploit this vulnerability. The specific flaw exists within the included HTTP server. By providing a small negative content length, an attacker is able to cause an integer overflow, resulting in the allocation of too small a buffer. The resulting heap overwrite will terminate the HTTP server. Trihedral VTScada is a SCADA industrial control product. Trihedral VTScada is prone to a denial-of-service vulnerability. Successful exploits can crash the affected application, denying service to legitimate users

Trust: 3.24

sources: NVD: CVE-2014-9192 // JVNDB: JVNDB-2014-005967 // ZDI: ZDI-14-425 // CNVD: CNVD-2014-08874 // BID: 71591 // IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-08874

AFFECTED PRODUCTS

vendor:trihedralmodel:vtscadascope:gteversion:6.5

Trust: 1.0

vendor:trihedralmodel:vtscadascope:ltversion:9.1.20

Trust: 1.0

vendor:trihedralmodel:vtscadascope:ltversion:11.1.07

Trust: 1.0

vendor:trihedralmodel:vtscadascope:gteversion:11.0

Trust: 1.0

vendor:trihedralmodel:vtscadascope:gteversion:10.0

Trust: 1.0

vendor:trihedralmodel:vtscadascope:ltversion:10.2.22

Trust: 1.0

vendor:trihedral engineeringmodel:vtscadascope:ltversion:10.x

Trust: 0.8

vendor:trihedral engineeringmodel:vtscadascope:ltversion:11.x

Trust: 0.8

vendor:trihedral engineeringmodel:vtscadascope:eqversion:( old vts) 6.5 from 9.1.20

Trust: 0.8

vendor:trihedral engineeringmodel:vtscadascope:ltversion:9.x

Trust: 0.8

vendor:trihedral engineeringmodel:vtscadascope:eqversion:( old vts) 11.1.07

Trust: 0.8

vendor:trihedral engineeringmodel:vtscadascope:eqversion:( old vts) 10.2.22

Trust: 0.8

vendor:trihedral engineeringmodel:vtscadascope: - version: -

Trust: 0.7

vendor:vtscadamodel: - scope:eqversion:*

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:6.5-9.x(<9.1.20)

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:6.5-10.x(<10.2.22)

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:6.5-11.x(<11.1.07)

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:10.0

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:11.0

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:10.2.21

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:9.0

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:6.5

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:9.1.19

Trust: 0.6

vendor:trihedralmodel:vtscadascope:eqversion:11.1.07

Trust: 0.6

sources: IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d // ZDI: ZDI-14-425 // CNVD: CNVD-2014-08874 // JVNDB: JVNDB-2014-005967 // CNNVD: CNNVD-201412-277 // NVD: CVE-2014-9192

CVSS

SEVERITY

CVSSV2

CVSSV3

ics-cert@hq.dhs.gov: CVE-2014-9192
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2014-9192
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-9192
value: MEDIUM

Trust: 0.8

ZDI: CVE-2014-9192
value: HIGH

Trust: 0.7

CNVD: CNVD-2014-08874
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201412-277
value: MEDIUM

Trust: 0.6

IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2014-9192
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ics-cert@hq.dhs.gov: CVE-2014-9192
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.7

CNVD: CNVD-2014-08874
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d // ZDI: ZDI-14-425 // CNVD: CNVD-2014-08874 // JVNDB: JVNDB-2014-005967 // CNNVD: CNNVD-201412-277 // NVD: CVE-2014-9192 // NVD: CVE-2014-9192

PROBLEMTYPE DATA

problemtype:CWE-189

Trust: 1.8

problemtype:CWE-190

Trust: 1.0

sources: JVNDB: JVNDB-2014-005967 // NVD: CVE-2014-9192

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201412-277

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-201412-277

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-005967

PATCH
title:Top Pageurl:http://www.trihedral.com/
Trust: 0.8
title:Trihedral Engineering Ltd  has issued an update to correct this vulnerability.url:https://ics-cert.us-cert.gov/advisories/ICSA-14-343-02
Trust: 0.7
title:Trihedral VTScada malformation request for denial of service vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/52717
Trust: 0.6
title:VTSCADA 11.1.09 Fullurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52973
Trust: 0.6
title:VTScada 10.2.22 Fullurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52972
Trust: 0.6
title:VTS 9.1.20url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52971
Trust: 0.6
sources:
            
            
            ZDI: ZDI-14-425 // 
            
            
            
            CNVD: CNVD-2014-08874 // 
            
            
            
            JVNDB: JVNDB-2014-005967 // 
            
            
            
            CNNVD: CNNVD-201412-277

EXTERNAL IDS
db:NVDid:CVE-2014-9192
Trust: 4.2
db:ICS CERTid:ICSA-14-343-02
Trust: 3.0
db:BIDid:71591
Trust: 1.9
db:CNVDid:CNVD-2014-08874
Trust: 0.8
db:CNNVDid:CNNVD-201412-277
Trust: 0.8
db:JVNDBid:JVNDB-2014-005967
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-2599
Trust: 0.7
db:ZDIid:ZDI-14-425
Trust: 0.7
db:IVDid:B0E1AD4A-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
sources:
            
            
            IVD: b0e1ad4a-2351-11e6-abef-000c29c66e3d // 
            
            
            
            ZDI: ZDI-14-425 // 
            
            
            
            CNVD: CNVD-2014-08874 // 
            
            
            
            BID: 71591 // 
            
            
            
            JVNDB: JVNDB-2014-005967 // 
            
            
            
            CNNVD: CNNVD-201412-277 // 
            
            
            
            NVD: CVE-2014-9192

REFERENCES
url:https://ics-cert.us-cert.gov//advisories/icsa-14-343-02
Trust: 2.4
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9192
Trust: 1.4
url:https://ics-cert.us-cert.gov/advisories/icsa-14-343-02
Trust: 1.3
url:http://www.trihedral.com/help/#op_welcome/wel_upgradenotes.htm
Trust: 1.0
url:http://www.securityfocus.com/bid/71591
Trust: 1.0
url:https://www.cisa.gov/news-events/ics-advisories/icsa-14-343-02
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9192
Trust: 0.8
sources:
            
            
            ZDI: ZDI-14-425 // 
            
            
            
            CNVD: CNVD-2014-08874 // 
            
            
            
            JVNDB: JVNDB-2014-005967 // 
            
            
            
            CNNVD: CNNVD-201412-277 // 
            
            
            
            NVD: CVE-2014-9192

CREDITS
Anonymous
Trust: 0.7
sources:
            
            
            ZDI: ZDI-14-425

SOURCES
db:IVDid:b0e1ad4a-2351-11e6-abef-000c29c66e3d
db:ZDIid:ZDI-14-425
db:CNVDid:CNVD-2014-08874
db:BIDid:71591
db:JVNDBid:JVNDB-2014-005967
db:CNNVDid:CNNVD-201412-277
db:NVDid:CVE-2014-9192

LAST UPDATE DATE
2025-07-26T23:21:01.154000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-14-425date:2014-12-12T00:00:00
db:CNVDid:CNVD-2014-08874date:2014-12-12T00:00:00
db:BIDid:71591date:2015-07-15T00:14:00
db:JVNDBid:JVNDB-2014-005967date:2014-12-15T00:00:00
db:CNNVDid:CNNVD-201412-277date:2019-02-11T00:00:00
db:NVDid:CVE-2014-9192date:2025-07-25T17:15:27.680

SOURCES RELEASE DATE
db:IVDid:b0e1ad4a-2351-11e6-abef-000c29c66e3ddate:2014-12-12T00:00:00
db:ZDIid:ZDI-14-425date:2014-12-12T00:00:00
db:CNVDid:CNVD-2014-08874date:2014-12-12T00:00:00
db:BIDid:71591date:2014-12-09T00:00:00
db:JVNDBid:JVNDB-2014-005967date:2014-12-15T00:00:00
db:CNNVDid:CNNVD-201412-277date:2014-12-12T00:00:00
db:NVDid:CVE-2014-9192date:2014-12-11T15:59:04.773