Sign-up

ID

VAR-201801-0158


CVE

CVE-2017-16740


TITLE

Rockwell Automation Allen-Bradley MicroLogix 1400 Buffer error vulnerability in the controller

Trust: 0.8

sources: JVNDB: JVNDB-2017-012022

DESCRIPTION

A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and earlier. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution. Rockwell Automation Allen-Bradley MicroLogix 1400 The controller contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Due to the nature of this issue, code execution may be possible but this has not been confirmed

Trust: 2.79

sources: NVD: CVE-2017-16740 // JVNDB: JVNDB-2017-012022 // CNVD: CNVD-2018-00883 // BID: 102474 // IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1 // VULHUB: VHN-107693 // VULMON: CVE-2017-16740

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1 // CNVD: CNVD-2018-00883

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:1766-l32bxbascope:lteversion:21.002

Trust: 1.0

vendor:rockwellautomationmodel:1766-l32bwaascope:lteversion:21.002

Trust: 1.0

vendor:rockwellautomationmodel:1766-l32bwascope:lteversion:21.002

Trust: 1.0

vendor:rockwellautomationmodel:1766-l32awaascope:lteversion:21.002

Trust: 1.0

vendor:rockwellautomationmodel:1766-l32awascope:lteversion:21.002

Trust: 1.0

vendor:rockwellautomationmodel:1766-l32bxbscope:lteversion:21.002

Trust: 1.0

vendor:rockwell automationmodel:1766-l32awascope: - version: -

Trust: 0.8

vendor:rockwell automationmodel:1766-l32awaascope: - version: -

Trust: 0.8

vendor:rockwell automationmodel:1766-l32bwascope: - version: -

Trust: 0.8

vendor:rockwell automationmodel:1766-l32bwaascope: - version: -

Trust: 0.8

vendor:rockwell automationmodel:1766-l32bxbscope: - version: -

Trust: 0.8

vendor:rockwell automationmodel:1766-l32bxbascope: - version: -

Trust: 0.8

vendor:rockwellmodel:automation micrologix 1766-l32bxbascope:eqversion:1400<=21.002

Trust: 0.6

vendor:rockwellmodel:automation micrologix 1766-l32bxbscope:eqversion:1400<=21.002

Trust: 0.6

vendor:rockwellmodel:automation micrologix 1766-l32bwaascope:eqversion:1400<=21.002

Trust: 0.6

vendor:rockwellmodel:automation micrologix 1766-l32bwascope:eqversion:1400<=21.002

Trust: 0.6

vendor:rockwellmodel:automation micrologix 1766-l32awaascope:eqversion:1400<=21.002

Trust: 0.6

vendor:rockwellmodel:automation micrologix 1766-l32awascope:eqversion:1400<=21.002

Trust: 0.6

vendor:rockwellautomationmodel:1766-l32bwascope:eqversion:21.002

Trust: 0.6

vendor:rockwellautomationmodel:1766-l32bxbascope:eqversion:21.002

Trust: 0.6

vendor:rockwellautomationmodel:1766-l32awaascope:eqversion:21.002

Trust: 0.6

vendor:rockwellautomationmodel:1766-l32awascope:eqversion:21.002

Trust: 0.6

vendor:rockwellautomationmodel:1766-l32bwaascope:eqversion:21.002

Trust: 0.6

vendor:rockwellautomationmodel:1766-l32bxbscope:eqversion:21.002

Trust: 0.6

vendor:rockwellmodel:automation micrologix 1766-l32bxbascope:eqversion:140021.002

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32bxbscope:eqversion:140021.002

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32bwaascope:eqversion:140021.002

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32bwascope:eqversion:140021.002

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32awaascope:eqversion:140021.002

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32awascope:eqversion:140021.002

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32bxbascope:neversion:140021.003

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32bxbscope:neversion:140021.003

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32bwaascope:neversion:140021.003

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32bwascope:neversion:140021.003

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32awaascope:neversion:140021.003

Trust: 0.3

vendor:rockwellmodel:automation micrologix 1766-l32awascope:neversion:140021.003

Trust: 0.3

vendor:1766 l32bxbamodel: - scope:eqversion:*

Trust: 0.2

vendor:1766 l32awamodel: - scope:eqversion:*

Trust: 0.2

vendor:1766 l32bxbmodel: - scope:eqversion:*

Trust: 0.2

vendor:1766 l32bwaamodel: - scope:eqversion:*

Trust: 0.2

vendor:1766 l32awaamodel: - scope:eqversion:*

Trust: 0.2

vendor:1766 l32bwamodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1 // CNVD: CNVD-2018-00883 // BID: 102474 // JVNDB: JVNDB-2017-012022 // CNNVD: CNNVD-201801-329 // NVD: CVE-2017-16740

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-16740
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-16740
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-00883
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201801-329
value: HIGH

Trust: 0.6

IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1
value: HIGH

Trust: 0.2

VULHUB: VHN-107693
value: HIGH

Trust: 0.1

VULMON: CVE-2017-16740
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-16740
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-00883
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-107693
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-16740
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 6.0
version: 3.0

Trust: 1.8

sources: IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1 // CNVD: CNVD-2018-00883 // VULHUB: VHN-107693 // VULMON: CVE-2017-16740 // JVNDB: JVNDB-2017-012022 // CNNVD: CNNVD-201801-329 // NVD: CVE-2017-16740

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

problemtype:CWE-120

Trust: 1.0

sources: VULHUB: VHN-107693 // JVNDB: JVNDB-2017-012022 // NVD: CVE-2017-16740

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201801-329

TYPE

Buffer overflow

Trust: 0.8

sources: IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1 // CNNVD: CNNVD-201801-329

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-012022

PATCH
title:MicroLogix 1400コントローラurl:http://ab.rockwellautomation.com/ja/Programmable-Controllers/MicroLogix-1400
Trust: 0.8
title:Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers Series B and C Buffer Overflow Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/113399
Trust: 0.6
title:Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers Series B  and C Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=77602
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-00883 // 
            
            
            
            JVNDB: JVNDB-2017-012022 // 
            
            
            
            CNNVD: CNNVD-201801-329

EXTERNAL IDS
db:NVDid:CVE-2017-16740
Trust: 3.7
db:ICS CERTid:ICSA-18-009-01
Trust: 3.5
db:BIDid:102474
Trust: 2.1
db:CNNVDid:CNNVD-201801-329
Trust: 0.9
db:CNVDid:CNVD-2018-00883
Trust: 0.8
db:JVNDBid:JVNDB-2017-012022
Trust: 0.8
db:NSFOCUSid:38658
Trust: 0.6
db:IVDid:E2E17CCF-39AB-11E9-8B0C-000C29342CB1
Trust: 0.2
db:SEEBUGid:SSVID-99028
Trust: 0.1
db:VULHUBid:VHN-107693
Trust: 0.1
db:VULMONid:CVE-2017-16740
Trust: 0.1
sources:
            
            
            IVD: e2e17ccf-39ab-11e9-8b0c-000c29342cb1 // 
            
            
            
            CNVD: CNVD-2018-00883 // 
            
            
            
            VULHUB: VHN-107693 // 
            
            
            
            VULMON: CVE-2017-16740 // 
            
            
            
            BID: 102474 // 
            
            
            
            JVNDB: JVNDB-2017-012022 // 
            
            
            
            CNNVD: CNNVD-201801-329 // 
            
            
            
            NVD: CVE-2017-16740

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-18-009-01
Trust: 3.5
url:http://www.securityfocus.com/bid/102474
Trust: 1.8
url:https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1070883
Trust: 1.2
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-16740
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-16740
Trust: 0.8
url:https://tools.cisco.com/security/center/viewalert.x?alertid=56434
Trust: 0.7
url:http://www.nsfocus.net/vulndb/38658
Trust: 0.6
url:http://www.rockwellautomation.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-00883 // 
            
            
            
            VULHUB: VHN-107693 // 
            
            
            
            VULMON: CVE-2017-16740 // 
            
            
            
            BID: 102474 // 
            
            
            
            JVNDB: JVNDB-2017-012022 // 
            
            
            
            CNNVD: CNNVD-201801-329 // 
            
            
            
            NVD: CVE-2017-16740

CREDITS
Thiago Alves of the University of Alabama.
Trust: 0.3
sources:
            
            
            BID: 102474

SOURCES
db:IVDid:e2e17ccf-39ab-11e9-8b0c-000c29342cb1
db:CNVDid:CNVD-2018-00883
db:VULHUBid:VHN-107693
db:VULMONid:CVE-2017-16740
db:BIDid:102474
db:JVNDBid:JVNDB-2017-012022
db:CNNVDid:CNNVD-201801-329
db:NVDid:CVE-2017-16740

LAST UPDATE DATE
2024-11-23T22:48:52.080000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-00883date:2018-01-15T00:00:00
db:VULHUBid:VHN-107693date:2018-08-16T00:00:00
db:VULMONid:CVE-2017-16740date:2018-08-16T00:00:00
db:BIDid:102474date:2018-01-09T00:00:00
db:JVNDBid:JVNDB-2017-012022date:2018-02-13T00:00:00
db:CNNVDid:CNNVD-201801-329date:2018-01-10T00:00:00
db:NVDid:CVE-2017-16740date:2024-11-21T03:16:52.917

SOURCES RELEASE DATE
db:IVDid:e2e17ccf-39ab-11e9-8b0c-000c29342cb1date:2018-01-15T00:00:00
db:CNVDid:CNVD-2018-00883date:2018-01-15T00:00:00
db:VULHUBid:VHN-107693date:2018-01-09T00:00:00
db:VULMONid:CVE-2017-16740date:2018-01-09T00:00:00
db:BIDid:102474date:2018-01-09T00:00:00
db:JVNDBid:JVNDB-2017-012022date:2018-02-13T00:00:00
db:CNNVDid:CNNVD-201801-329date:2018-01-10T00:00:00
db:NVDid:CVE-2017-16740date:2018-01-09T21:29:00.420