Details of VAR-201801-0960

ID

VAR-201801-0960

CVE

CVE-2017-12697

TITLE

General Motors - Shanghai OnStar of SOS iOS Client Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2017-012084

DESCRIPTION

A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects to the server. General Motors Shanghai OnStar is prone to multiple security vulnerabilities. Shanghai OnStar 7.1 is vulnerable; other versions may also be affected

Trust: 2.61

sources: NVD: CVE-2017-12697 // JVNDB: JVNDB-2017-012084 // CNVD: CNVD-2018-00882 // BID: 102481 // IVD: e2e17cd0-39ab-11e9-9a74-000c29342cb1

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: e2e17cd0-39ab-11e9-9a74-000c29342cb1 // CNVD: CNVD-2018-00882

AFFECTED PRODUCTS

vendor:	gm	model:	shanghai onstar	scope:	eq	version:	7.1	Trust: 1.6
vendor:	general motors onstar	model:	sos ios client	scope:	eq	version:	7.1	Trust: 0.8
vendor:	general	model:	motorsgm shanghai onstarsosios client	scope:	eq	version:	7.1	Trust: 0.6
vendor:	general	model:	motors shanghai onstar	scope:	eq	version:	7.1	Trust: 0.3
vendor:	general	model:	motors shanghai onstar	scope:	ne	version:	7.2	Trust: 0.3
vendor:	onstar	model:	-	scope:	eq	version:	7.1	Trust: 0.2

sources: IVD: e2e17cd0-39ab-11e9-9a74-000c29342cb1 // CNVD: CNVD-2018-00882 // BID: 102481 // JVNDB: JVNDB-2017-012084 // CNNVD: CNNVD-201801-332 // NVD: CVE-2017-12697

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-12697
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-12697
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2018-00882
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201801-332
value:	MEDIUM
Trust: 0.6
IVD:	e2e17cd0-39ab-11e9-9a74-000c29342cb1
value:	MEDIUM
Trust: 0.2

nvd@nist.gov:	CVE-2017-12697
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-00882
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	e2e17cd0-39ab-11e9-9a74-000c29342cb1
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2017-12697
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: IVD: e2e17cd0-39ab-11e9-9a74-000c29342cb1 // CNVD: CNVD-2018-00882 // JVNDB: JVNDB-2017-012084 // CNNVD: CNNVD-201801-332 // NVD: CVE-2017-12697

PROBLEMTYPE DATA

problemtype:	CWE-200	Trust: 1.8
problemtype:	CWE-300	Trust: 1.0

sources: JVNDB: JVNDB-2017-012084 // NVD: CVE-2017-12697

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201801-332

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201801-332

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-012084

PATCH

title:	Top Page	url:	https://www.onstar.com/us/en/home/	Trust: 0.8
title:	General Motors and Shanghai OnStar iOS Client Man-in-the-Middle Attack Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/113375	Trust: 0.6

sources: CNVD: CNVD-2018-00882 // JVNDB: JVNDB-2017-012084

EXTERNAL IDS

db:	NVD	id:	CVE-2017-12697	Trust: 3.5
db:	ICS CERT	id:	ICSA-17-234-04	Trust: 3.3
db:	BID	id:	102481	Trust: 2.5
db:	CNVD	id:	CNVD-2018-00882	Trust: 0.8
db:	CNNVD	id:	CNNVD-201801-332	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-012084	Trust: 0.8
db:	IVD	id:	E2E17CD0-39AB-11E9-9A74-000C29342CB1	Trust: 0.2

sources: IVD: e2e17cd0-39ab-11e9-9a74-000c29342cb1 // CNVD: CNVD-2018-00882 // BID: 102481 // JVNDB: JVNDB-2017-012084 // CNNVD: CNNVD-201801-332 // NVD: CVE-2017-12697

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-17-234-04	Trust: 3.0
url:	http://www.securityfocus.com/bid/102481	Trust: 2.2
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12697	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-12697	Trust: 0.8
url:	https://www.gm.com/	Trust: 0.3
url:	https://ics-cert.us-cert.gov/advisories/icsa-17-234-04 icsa-17-234-04	Trust: 0.3

sources: CNVD: CNVD-2018-00882 // BID: 102481 // JVNDB: JVNDB-2017-012084 // CNNVD: CNNVD-201801-332 // NVD: CVE-2017-12697

CREDITS

Charles Gans

Trust: 0.3

sources: BID: 102481

SOURCES

db:	IVD	id:	e2e17cd0-39ab-11e9-9a74-000c29342cb1
db:	CNVD	id:	CNVD-2018-00882
db:	BID	id:	102481
db:	JVNDB	id:	JVNDB-2017-012084
db:	CNNVD	id:	CNNVD-201801-332
db:	NVD	id:	CVE-2017-12697

LAST UPDATE DATE

2024-11-23T22:12:42.400000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-00882	date:	2018-01-15T00:00:00
db:	BID	id:	102481	date:	2018-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2017-012084	date:	2018-02-16T00:00:00
db:	CNNVD	id:	CNNVD-201801-332	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-12697	date:	2024-11-21T03:10:02.973

SOURCES RELEASE DATE

db:	IVD	id:	e2e17cd0-39ab-11e9-9a74-000c29342cb1	date:	2018-01-15T00:00:00
db:	CNVD	id:	CNVD-2018-00882	date:	2018-01-15T00:00:00
db:	BID	id:	102481	date:	2018-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2017-012084	date:	2018-02-16T00:00:00
db:	CNNVD	id:	CNNVD-201801-332	date:	2018-01-10T00:00:00
db:	NVD	id:	CVE-2017-12697	date:	2018-01-09T21:29:00.297