Details of VAR-201412-0535

ID

VAR-201412-0535

CVE

CVE-2014-8269

TITLE

Honeywell OPOS suite Stack Buffer Overflow vulnerability

Trust: 1.6

sources: CERT/CC: VU#659684 // JVNDB: JVNDB-2014-005999

DESCRIPTION

Multiple stack-based buffer overflows in (1) HWOPOSScale.ocx and (2) HWOPOSSCANNER.ocx in Honeywell OPOS Suite before 1.13.4.15 allow remote attackers to execute arbitrary code via a crafted file that is improperly handled by the Open method. Honeywell OPOS Suite Contains a stack buffer overflow vulnerability. Honeywell OPOS (OLE for Retail Point-of-Sale (POS)) Suite Is Microsoft Windows OS For retail operating in POS Software used in the system. CWE-121: Stack-based Buffer Overflow http://cwe.mitre.org/data/definitions/121.html About this vulnerability Zero Day Initiative To advisory (ZDI-14-423 and ZDI-14-424) Is published. Zero Day Initiative Advisory ZDI-14-423 http://www.zerodayinitiative.com/advisories/ZDI-14-423/ Zero Day Initiative Advisory ZDI-14-424 http://www.zerodayinitiative.com/advisories/ZDI-14-424/If a user loads a malicious page or opens a malicious file, arbitrary code may be executed. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the HWOPOSSCANNER.ocx. This allows an attacker to execute arbitrary code in the context of the browser process. Honeywell OPOS Suite is a 2D industrial grade barcode scanner solution. Failed exploit attempts will likely result in denial-of-service conditions

Trust: 4.59

sources: NVD: CVE-2014-8269 // CERT/CC: VU#659684 // JVNDB: JVNDB-2014-005999 // ZDI: ZDI-14-424 // ZDI: ZDI-14-423 // CNVD: CNVD-2014-08955 // BID: 71642 // IVD: b07842ce-2351-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: b07842ce-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-08955

AFFECTED PRODUCTS

vendor:	honeywell	model:	opos suite	scope:	-	version:	-	Trust: 1.4
vendor:	honeywell	model:	opos suite	scope:	lte	version:	1.13.4.14	Trust: 1.0
vendor:	honeywell	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	honeywell	model:	opos suite	scope:	lt	version:	1.13.4.15 earlier	Trust: 0.8
vendor:	honeywell	model:	opos suite	scope:	lt	version:	1.13.4.15	Trust: 0.6
vendor:	honeywell	model:	opos suite	scope:	eq	version:	1.13.4.14	Trust: 0.6
vendor:	opos suite	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: b07842ce-2351-11e6-abef-000c29c66e3d // CERT/CC: VU#659684 // ZDI: ZDI-14-424 // ZDI: ZDI-14-423 // CNVD: CNVD-2014-08955 // JVNDB: JVNDB-2014-005999 // CNNVD: CNNVD-201412-333 // NVD: CVE-2014-8269

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2014-8269
value:	HIGH
Trust: 1.4
nvd@nist.gov:	CVE-2014-8269
value:	HIGH
Trust: 1.0
NVD:	CVE-2014-8269
value:	HIGH
Trust: 0.8
IPA:	JVNDB-2014-005999
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2014-08955
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201412-333
value:	HIGH
Trust: 0.6
IVD:	b07842ce-2351-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2014-8269
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 2.4
NVD:	CVE-2014-8269
severity:	HIGH
baseScore:	7.5
vectorString:	NONE
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
IPA:	JVNDB-2014-005999
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2014-08955
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	b07842ce-2351-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

PROBLEMTYPE DATA

problemtype:	CWE-119	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2014-005999 // NVD: CVE-2014-8269

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201412-333

TYPE

Buffer overflow

Trust: 0.8

sources: IVD: b07842ce-2351-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201412-333

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-005999

EXPLOIT AVAILABILITY

sources: CERT/CC: VU#659684

PATCH

title:	Honeywell has issued an update to correct this vulnerability.	url:	http://www.kb.cert.org/vuls/id/659684	Trust: 1.4
title:	Honeywell OPOS Suite_1_13_4_15.zip	url:	http://www.honeywellaidc.com/forms/HSMDownloadForm.aspx?df=CatalogDocuments/Honeywell%20OPOS%20Suite_1_13_4_15.zip	Trust: 0.8
title:	Honeywell OPOS Suite 'HWOPOSSCANNER.ocx' patch buffer overflow vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/52904	Trust: 0.6

sources: ZDI: ZDI-14-424 // ZDI: ZDI-14-423 // CNVD: CNVD-2014-08955 // JVNDB: JVNDB-2014-005999

EXTERNAL IDS

db:	NVD	id:	CVE-2014-8269	Trust: 4.9
db:	ZDI	id:	ZDI-14-423	Trust: 4.5
db:	ZDI	id:	ZDI-14-424	Trust: 3.9
db:	CERT/CC	id:	VU#659684	Trust: 3.2
db:	BID	id:	71642	Trust: 1.5
db:	CNVD	id:	CNVD-2014-08955	Trust: 0.8
db:	CNNVD	id:	CNNVD-201412-333	Trust: 0.8
db:	JVN	id:	JVNVU98107585	Trust: 0.8
db:	JVNDB	id:	JVNDB-2014-005999	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-2527	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-2528	Trust: 0.7
db:	IVD	id:	B07842CE-2351-11E6-ABEF-000C29C66E3D	Trust: 0.2

sources: IVD: b07842ce-2351-11e6-abef-000c29c66e3d // CERT/CC: VU#659684 // ZDI: ZDI-14-424 // ZDI: ZDI-14-423 // CNVD: CNVD-2014-08955 // BID: 71642 // JVNDB: JVNDB-2014-005999 // CNNVD: CNNVD-201412-333 // NVD: CVE-2014-8269

REFERENCES

url:	http://www.zerodayinitiative.com/advisories/zdi-14-423/	Trust: 3.8
url:	http://www.kb.cert.org/vuls/id/659684	Trust: 3.8
url:	http://www.zerodayinitiative.com/advisories/zdi-14-424/	Trust: 3.2
url:	http://www.honeywellaidc.com/forms/hsmdownloadform.aspx?df=catalogdocuments/honeywell%20opos%20suite_1_13_4_15.zip	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-8269	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu98107585/index.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-8269	Trust: 0.8
url:	http://www.securityfocus.com/bid/71642	Trust: 0.6
url:	http://www.security.honeywell.com/	Trust: 0.3

sources: CERT/CC: VU#659684 // ZDI: ZDI-14-424 // ZDI: ZDI-14-423 // CNVD: CNVD-2014-08955 // BID: 71642 // JVNDB: JVNDB-2014-005999 // CNNVD: CNNVD-201412-333 // NVD: CVE-2014-8269

CREDITS

Ariele Caltabiano (kimiya)

Trust: 2.3

sources: ZDI: ZDI-14-424 // ZDI: ZDI-14-423 // BID: 71642 // CNNVD: CNNVD-201412-333

SOURCES

db:	IVD	id:	b07842ce-2351-11e6-abef-000c29c66e3d
db:	CERT/CC	id:	VU#659684
db:	ZDI	id:	ZDI-14-424
db:	ZDI	id:	ZDI-14-423
db:	CNVD	id:	CNVD-2014-08955
db:	BID	id:	71642
db:	JVNDB	id:	JVNDB-2014-005999
db:	CNNVD	id:	CNNVD-201412-333
db:	NVD	id:	CVE-2014-8269

LAST UPDATE DATE

2025-04-13T23:21:19.250000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#659684	date:	2014-12-12T00:00:00
db:	ZDI	id:	ZDI-14-424	date:	2014-12-11T00:00:00
db:	ZDI	id:	ZDI-14-423	date:	2014-12-11T00:00:00
db:	CNVD	id:	CNVD-2014-08955	date:	2014-12-17T00:00:00
db:	BID	id:	71642	date:	2014-12-11T00:00:00
db:	JVNDB	id:	JVNDB-2014-005999	date:	2014-12-16T00:00:00
db:	CNNVD	id:	CNNVD-201412-333	date:	2014-12-16T00:00:00
db:	NVD	id:	CVE-2014-8269	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	IVD	id:	b07842ce-2351-11e6-abef-000c29c66e3d	date:	2014-12-17T00:00:00
db:	CERT/CC	id:	VU#659684	date:	2014-12-12T00:00:00
db:	ZDI	id:	ZDI-14-424	date:	2014-12-11T00:00:00
db:	ZDI	id:	ZDI-14-423	date:	2014-12-11T00:00:00
db:	CNVD	id:	CNVD-2014-08955	date:	2014-12-17T00:00:00
db:	BID	id:	71642	date:	2014-12-11T00:00:00
db:	JVNDB	id:	JVNDB-2014-005999	date:	2014-12-16T00:00:00
db:	CNNVD	id:	CNNVD-201412-333	date:	2014-12-15T00:00:00
db:	NVD	id:	CVE-2014-8269	date:	2014-12-13T00:59:01.273