Details of VAR-201802-1046

ID

VAR-201802-1046

CVE

CVE-2018-5457

TITLE

Vyaire Medical CareFusion Upgrade Utility Vulnerabilities in uncontrolled search path elements

Trust: 0.8

sources: JVNDB: JVNDB-2018-002233

DESCRIPTION

A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior versions. A successful exploit of this vulnerability requires the local user to install a crafted DLL on the target machine. The application loads the DLL and gives the attacker access at the same privilege level as the application. CareFusion Upgrade Utility is prone to a local privilege-escalation vulnerability. Local attackers may exploit this issue to execute arbitrary code with administrative privileges

Trust: 2.61

sources: NVD: CVE-2018-5457 // JVNDB: JVNDB-2018-002233 // CNVD: CNVD-2018-03304 // BID: 102983 // IVD: e2e378a2-39ab-11e9-a253-000c29342cb1

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: e2e378a2-39ab-11e9-a253-000c29342cb1 // CNVD: CNVD-2018-03304

AFFECTED PRODUCTS

vendor:	vyaire	model:	carefusion upgrade utility	scope:	lte	version:	2.0.2.2	Trust: 1.0
vendor:	vyaire	model:	carefusion upgrade utility	scope:	eq	version:	2.0.2.2	Trust: 0.9
vendor:	vyaire medical	model:	carefusion upgrade utility	scope:	lte	version:	2.0.2.2	Trust: 0.8
vendor:	vyaire	model:	medical carefusion upgrade utility	scope:	lte	version:	<=2.0.2.2	Trust: 0.6
vendor:	vyaire	model:	carefusion upgrade utility	scope:	ne	version:	2.0.3.0	Trust: 0.3
vendor:	carefusion upgrade utility	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: e2e378a2-39ab-11e9-a253-000c29342cb1 // CNVD: CNVD-2018-03304 // BID: 102983 // JVNDB: JVNDB-2018-002233 // CNNVD: CNNVD-201802-151 // NVD: CVE-2018-5457

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-5457
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-5457
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-03304
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201802-151
value:	HIGH
Trust: 0.6
IVD:	e2e378a2-39ab-11e9-a253-000c29342cb1
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2018-5457
severity:	MEDIUM
baseScore:	6.9
vectorString:	AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.4
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-03304
severity:	MEDIUM
baseScore:	6.2
vectorString:	AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	1.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	e2e378a2-39ab-11e9-a253-000c29342cb1
severity:	MEDIUM
baseScore:	6.2
vectorString:	AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	1.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2018-5457
baseSeverity:	HIGH
baseScore:	7.0
vectorString:	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.0
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: IVD: e2e378a2-39ab-11e9-a253-000c29342cb1 // CNVD: CNVD-2018-03304 // JVNDB: JVNDB-2018-002233 // CNNVD: CNNVD-201802-151 // NVD: CVE-2018-5457

PROBLEMTYPE DATA

problemtype:

CWE-427

Trust: 1.8

sources: JVNDB: JVNDB-2018-002233 // NVD: CVE-2018-5457

THREAT TYPE

local

Trust: 0.9

sources: BID: 102983 // CNNVD: CNNVD-201802-151

TYPE

Code problem

Trust: 0.8

sources: IVD: e2e378a2-39ab-11e9-a253-000c29342cb1 // CNNVD: CNNVD-201802-151

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-002233

PATCH

title:	Top Page	url:	https://www.vyaire.com/	Trust: 0.8
title:	Vyaire Medical CareFusion Upgrade Utility privilege escalation patch	url:	https://www.cnvd.org.cn/patchInfo/show/116473	Trust: 0.6

sources: CNVD: CNVD-2018-03304 // JVNDB: JVNDB-2018-002233

EXTERNAL IDS

db:	NVD	id:	CVE-2018-5457	Trust: 3.5
db:	ICS CERT	id:	ICSMA-18-037-01	Trust: 3.3
db:	BID	id:	102983	Trust: 1.9
db:	CNVD	id:	CNVD-2018-03304	Trust: 0.8
db:	CNNVD	id:	CNNVD-201802-151	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-002233	Trust: 0.8
db:	IVD	id:	E2E378A2-39AB-11E9-A253-000C29342CB1	Trust: 0.2

sources: IVD: e2e378a2-39ab-11e9-a253-000c29342cb1 // CNVD: CNVD-2018-03304 // BID: 102983 // JVNDB: JVNDB-2018-002233 // CNNVD: CNNVD-201802-151 // NVD: CVE-2018-5457

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsma-18-037-01	Trust: 3.3
url:	http://www.securityfocus.com/bid/102983	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2018-5457	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5457	Trust: 0.8
url:	https://www.vyaire.com/us	Trust: 0.3

sources: CNVD: CNVD-2018-03304 // BID: 102983 // JVNDB: JVNDB-2018-002233 // CNNVD: CNNVD-201802-151 // NVD: CVE-2018-5457

CREDITS

Mark Cross (@xerubus)

Trust: 0.3

sources: BID: 102983

SOURCES

db:	IVD	id:	e2e378a2-39ab-11e9-a253-000c29342cb1
db:	CNVD	id:	CNVD-2018-03304
db:	BID	id:	102983
db:	JVNDB	id:	JVNDB-2018-002233
db:	CNNVD	id:	CNNVD-201802-151
db:	NVD	id:	CVE-2018-5457

LAST UPDATE DATE

2024-11-23T22:22:12.883000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-03304	date:	2018-02-13T00:00:00
db:	BID	id:	102983	date:	2018-02-06T00:00:00
db:	JVNDB	id:	JVNDB-2018-002233	date:	2018-04-03T00:00:00
db:	CNNVD	id:	CNNVD-201802-151	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-5457	date:	2024-11-21T04:08:50.283

SOURCES RELEASE DATE

db:	IVD	id:	e2e378a2-39ab-11e9-a253-000c29342cb1	date:	2018-02-13T00:00:00
db:	CNVD	id:	CNVD-2018-03304	date:	2018-02-13T00:00:00
db:	BID	id:	102983	date:	2018-02-06T00:00:00
db:	JVNDB	id:	JVNDB-2018-002233	date:	2018-04-03T00:00:00
db:	CNNVD	id:	CNNVD-201802-151	date:	2018-02-07T00:00:00
db:	NVD	id:	CVE-2018-5457	date:	2018-02-06T21:29:00.473