Sign-up

ID

VAR-201802-0614


CVE

CVE-2017-9967


TITLE

Schneider Electric IGSS SCADA Software Native code execution vulnerability

Trust: 0.8

sources: IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1 // CNVD: CNVD-2018-03482

DESCRIPTION

A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Address Space Layout Randomization (ASLR) and Data Execution prevention (DEP) were not properly configured resulting in weak security. Schneider Electric IGSS SCADA Software Contains a vulnerability related to configuration settings.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Schneider Electric IGSS SCADA Software is a shared service platform for SCADA (Data Acquisition and Surveillance Control) systems from Schneider Electric, France. A local attacker can exploit the vulnerability to execute arbitrary code in the context of the affected application. Failed attempts may lead to denial-of-service conditions

Trust: 2.7

sources: NVD: CVE-2017-9967 // JVNDB: JVNDB-2017-012623 // CNVD: CNVD-2018-03482 // BID: 103022 // IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1 // VULHUB: VHN-118170

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1 // CNVD: CNVD-2018-03482

AFFECTED PRODUCTS

vendor:schneider electricmodel:interactive graphical scada systemscope:lteversion:12.0

Trust: 1.0

vendor:schneider electricmodel:interactive graphical scada systemscope:lteversion:12

Trust: 0.8

vendor:schneidermodel:electric igss scada softwarescope:lteversion:<=12

Trust: 0.6

vendor:schneider electricmodel:interactive graphical scada systemscope:eqversion:12.0

Trust: 0.6

vendor:schneider electricmodel:igss scada softwarescope:eqversion:12

Trust: 0.3

vendor:schneider electricmodel:igss scada softwarescope:neversion:13

Trust: 0.3

vendor:interactive graphical scada systemmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1 // CNVD: CNVD-2018-03482 // BID: 103022 // JVNDB: JVNDB-2017-012623 // CNNVD: CNNVD-201706-1081 // NVD: CVE-2017-9967

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9967
value: HIGH

Trust: 1.0

NVD: CVE-2017-9967
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-03482
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201706-1081
value: HIGH

Trust: 0.6

IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1
value: HIGH

Trust: 0.2

VULHUB: VHN-118170
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-9967
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-03482
severity: MEDIUM
baseScore: 5.0
vectorString: AV:L/AC:H/AU:S/C:P/I:C/A:P
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: COMPLETE
availabilityImpact: PARTIAL
exploitabilityScore: 1.5
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1
severity: MEDIUM
baseScore: 5.0
vectorString: AV:L/AC:H/AU:S/C:P/I:C/A:P
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: COMPLETE
availabilityImpact: PARTIAL
exploitabilityScore: 1.5
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-118170
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-9967
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1 // CNVD: CNVD-2018-03482 // VULHUB: VHN-118170 // JVNDB: JVNDB-2017-012623 // CNNVD: CNNVD-201706-1081 // NVD: CVE-2017-9967

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-16

Trust: 0.9

sources: VULHUB: VHN-118170 // JVNDB: JVNDB-2017-012623 // NVD: CVE-2017-9967

THREAT TYPE

local

Trust: 0.9

sources: BID: 103022 // CNNVD: CNNVD-201706-1081

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201706-1081

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-012623

PATCH
title:SEVD-2018-037-01url:https://www.schneider-electric.com/en/download/document/SEVD-2018-037-01/
Trust: 0.8
title:Schneider Electric IGSS SCADA Software patch for native code execution vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/117899
Trust: 0.6
title:Schneider Electric IGSS SCADA Software Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99878
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-03482 // 
            
            
            
            JVNDB: JVNDB-2017-012623 // 
            
            
            
            CNNVD: CNNVD-201706-1081

EXTERNAL IDS
db:NVDid:CVE-2017-9967
Trust: 3.6
db:BIDid:103022
Trust: 2.6
db:ICS CERTid:ICSA-18-044-02
Trust: 1.7
db:SCHNEIDERid:SEVD-2018-037-01
Trust: 1.7
db:CNNVDid:CNNVD-201706-1081
Trust: 0.9
db:CNVDid:CNVD-2018-03482
Trust: 0.8
db:JVNDBid:JVNDB-2017-012623
Trust: 0.8
db:IVDid:E2E39FB0-39AB-11E9-A4A9-000C29342CB1
Trust: 0.2
db:SEEBUGid:SSVID-99014
Trust: 0.1
db:VULHUBid:VHN-118170
Trust: 0.1
sources:
            
            
            IVD: e2e39fb0-39ab-11e9-a4a9-000c29342cb1 // 
            
            
            
            CNVD: CNVD-2018-03482 // 
            
            
            
            VULHUB: VHN-118170 // 
            
            
            
            BID: 103022 // 
            
            
            
            JVNDB: JVNDB-2017-012623 // 
            
            
            
            CNNVD: CNNVD-201706-1081 // 
            
            
            
            NVD: CVE-2017-9967

REFERENCES
url:http://www.securityfocus.com/bid/103022
Trust: 2.3
url:https://ics-cert.us-cert.gov/advisories/icsa-18-044-02
Trust: 1.7
url:https://www.schneider-electric.com/en/download/document/sevd-2018-037-01/
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9967
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-9967
Trust: 0.8
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-03482 // 
            
            
            
            VULHUB: VHN-118170 // 
            
            
            
            BID: 103022 // 
            
            
            
            JVNDB: JVNDB-2017-012623 // 
            
            
            
            CNNVD: CNNVD-201706-1081 // 
            
            
            
            NVD: CVE-2017-9967

CREDITS
Ivan Sanchez of Nullcode
Trust: 0.3
sources:
            
            
            BID: 103022

SOURCES
db:IVDid:e2e39fb0-39ab-11e9-a4a9-000c29342cb1
db:CNVDid:CNVD-2018-03482
db:VULHUBid:VHN-118170
db:BIDid:103022
db:JVNDBid:JVNDB-2017-012623
db:CNNVDid:CNNVD-201706-1081
db:NVDid:CVE-2017-9967

LAST UPDATE DATE
2024-11-23T21:53:23.136000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-03482date:2018-02-26T00:00:00
db:VULHUBid:VHN-118170date:2019-10-03T00:00:00
db:BIDid:103022date:2018-02-13T00:00:00
db:JVNDBid:JVNDB-2017-012623date:2018-04-03T00:00:00
db:CNNVDid:CNNVD-201706-1081date:2020-07-14T00:00:00
db:NVDid:CVE-2017-9967date:2024-11-21T03:37:16.237

SOURCES RELEASE DATE
db:IVDid:e2e39fb0-39ab-11e9-a4a9-000c29342cb1date:2018-02-26T00:00:00
db:CNVDid:CNVD-2018-03482date:2018-02-26T00:00:00
db:VULHUBid:VHN-118170date:2018-02-12T00:00:00
db:BIDid:103022date:2018-02-13T00:00:00
db:JVNDBid:JVNDB-2017-012623date:2018-03-28T00:00:00
db:CNNVDid:CNNVD-201706-1081date:2017-06-27T00:00:00
db:NVDid:CVE-2017-9967date:2018-02-12T23:29:00.307