Details of VAR-201701-0612

ID

VAR-201701-0612

CVE

CVE-2015-2868

TITLE

Trane ComfortLink II Firmware DSS Service Remote Code Execution Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2015-007324

DESCRIPTION

An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution. Trane ComfortLink II is a set of connection control components used in home intelligence systems by Trane Company, UK. Trane ComfortLink II is prone to a remote code-execution vulnerability. Failed exploit attempts may cause a denial-of-service condition. Trane ComfortLink II 2.0.2 is vulnerable; other versions may also be affected

Trust: 2.52

sources: NVD: CVE-2015-2868 // JVNDB: JVNDB-2015-007324 // CNVD: CNVD-2016-04346 // BID: 95118 // VULHUB: VHN-80829

AFFECTED PRODUCTS

vendor:	trane	model:	comfortlink ii	scope:	eq	version:	2.0.2	Trust: 2.5
vendor:	train	model:	comfortlink ii	scope:	eq	version:	2.0.2	Trust: 0.8
vendor:	trane	model:	comfortlink ii	scope:	ne	version:	4.0.3	Trust: 0.3

sources: CNVD: CNVD-2016-04346 // BID: 95118 // JVNDB: JVNDB-2015-007324 // CNNVD: CNNVD-201606-543 // NVD: CVE-2015-2868

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-2868
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2015-2868
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2016-04346
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201606-543
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-80829
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-2868
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-04346
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-80829
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-2868
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2016-04346 // VULHUB: VHN-80829 // JVNDB: JVNDB-2015-007324 // CNNVD: CNNVD-201606-543 // NVD: CVE-2015-2868

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-80829 // JVNDB: JVNDB-2015-007324 // NVD: CVE-2015-2868

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201606-543

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201606-543

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-007324

PATCH

title:	TALOS-2016-0028	url:	http://www.talosintelligence.com/reports/TALOS-2016-0028/	Trust: 0.8
title:	トップページ	url:	http://www.jp.trane.com/ja.html	Trust: 0.8
title:	Patch for Trane ComfortLink II Stack Buffer Overflow Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/78241	Trust: 0.6

sources: CNVD: CNVD-2016-04346 // JVNDB: JVNDB-2015-007324

EXTERNAL IDS

db:	NVD	id:	CVE-2015-2868	Trust: 3.4
db:	TALOS	id:	TALOS-2016-0027	Trust: 2.6
db:	BID	id:	95118	Trust: 1.4
db:	JVNDB	id:	JVNDB-2015-007324	Trust: 0.8
db:	CNNVD	id:	CNNVD-201606-543	Trust: 0.7
db:	CNVD	id:	CNVD-2016-04346	Trust: 0.6
db:	VULHUB	id:	VHN-80829	Trust: 0.1

sources: CNVD: CNVD-2016-04346 // VULHUB: VHN-80829 // BID: 95118 // JVNDB: JVNDB-2015-007324 // CNNVD: CNNVD-201606-543 // NVD: CVE-2015-2868

REFERENCES

url:	http://www.talosintel.com/reports/talos-2016-0027	Trust: 1.2
url:	http://www.securityfocus.com/bid/95118	Trust: 1.1
url:	http://www.talosintelligence.com/reports/talos-2016-0027/	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2868	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2868	Trust: 0.8
url:	https://www.trane.com/residential/en/resources/smart-home-automation/installing-upgrading.html	Trust: 0.3
url:	http://www.talosintelligence.com/reports/talos-2016-0027/	Trust: 0.3

sources: CNVD: CNVD-2016-04346 // VULHUB: VHN-80829 // BID: 95118 // JVNDB: JVNDB-2015-007324 // CNNVD: CNNVD-201606-543 // NVD: CVE-2015-2868

CREDITS

Matt Watchinski and Christopher McBee of Cisco Talos

Trust: 0.9

sources: BID: 95118 // CNNVD: CNNVD-201606-543

SOURCES

db:	CNVD	id:	CNVD-2016-04346
db:	VULHUB	id:	VHN-80829
db:	BID	id:	95118
db:	JVNDB	id:	JVNDB-2015-007324
db:	CNNVD	id:	CNNVD-201606-543
db:	NVD	id:	CVE-2015-2868

LAST UPDATE DATE

2025-04-20T23:27:32.851000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-04346	date:	2016-06-29T00:00:00
db:	VULHUB	id:	VHN-80829	date:	2017-01-11T00:00:00
db:	BID	id:	95118	date:	2017-01-12T00:07:00
db:	JVNDB	id:	JVNDB-2015-007324	date:	2017-01-18T00:00:00
db:	CNNVD	id:	CNNVD-201606-543	date:	2017-01-11T00:00:00
db:	NVD	id:	CVE-2015-2868	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-04346	date:	2016-06-29T00:00:00
db:	VULHUB	id:	VHN-80829	date:	2017-01-06T00:00:00
db:	BID	id:	95118	date:	2016-02-08T00:00:00
db:	JVNDB	id:	JVNDB-2015-007324	date:	2017-01-18T00:00:00
db:	CNNVD	id:	CNNVD-201606-543	date:	2015-02-08T00:00:00
db:	NVD	id:	CVE-2015-2868	date:	2017-01-06T21:59:00.197