Sign-up

ID

VAR-201807-2225


TITLE

OSIsoft PI ProcessBook and PI ActiveView Arbitrary code execution vulnerability

Trust: 0.8

sources: IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd // CNVD: CNVD-2017-22848

DESCRIPTION

PI-ProcessBook is a powerful tool for displaying real-time data collected and stored by PI systems. PI-ActiveView is a Miscellaneous Shareware software. A remote code execution vulnerability exists in several OSIsoft PI products. An attacker could exploit this vulnerability to execute arbitrary code in the context of a user running in an affected application, and a failed attack would result in a denial of service. Failed exploit attempts will likely cause a denial-of-service condition. The following products are vulnerable: PI ProcessBook 2015 R2 3.6.0 and prior PI ActiveView 2015 R2 3.6.0 and prior

Trust: 1.71

sources: CNVD: CNVD-2018-12932 // CNVD: CNVD-2017-22848 // BID: 100483 // IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1 // IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.6

sources: IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1 // IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd // CNVD: CNVD-2018-12932 // CNVD: CNVD-2017-22848

AFFECTED PRODUCTS

vendor:osisoftmodel:pi activeview r2scope:eqversion:20153.6

Trust: 1.1

vendor:osisoftmodel:pi processbook r2scope:eqversion:20153.6

Trust: 0.9

vendor:osisoftmodel:pi processbook r2scope:lteversion:<=2015(3.6.0)

Trust: 0.8

vendor:osisoftmodel:pi activeview r2scope:lteversion:<=2015(3.6.0)

Trust: 0.8

vendor:osisoftmodel:pi processbook r2 sp1scope:neversion:20153.6.1

Trust: 0.3

vendor:osisoftmodel:pi activeview r2 sp1scope:neversion:20153.6.1

Trust: 0.3

vendor:osisoftmodel:pi processbook r2scope:eqversion:20153.6*

Trust: 0.2

sources: IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1 // IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd // CNVD: CNVD-2018-12932 // CNVD: CNVD-2017-22848 // BID: 100483

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2018-12932
value: HIGH

Trust: 0.6

CNVD: CNVD-2017-22848
value: HIGH

Trust: 0.6

IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1
value: HIGH

Trust: 0.2

IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd
value: HIGH

Trust: 0.2

CNVD: CNVD-2018-12932
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2017-22848
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1 // IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd // CNVD: CNVD-2018-12932 // CNVD: CNVD-2017-22848

THREAT TYPE

network

Trust: 0.3

sources: BID: 100483

TYPE

Code injection

Trust: 0.4

sources: IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1 // IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd

PATCH

title:Patches for multiple OSIsoft PI product remote code execution vulnerabilitiesurl:https://www.cnvd.org.cn/patchinfo/show/134127

Trust: 0.6

title:OSIsoft PI ProcessBook and PI ActiveView patch for arbitrary code execution vulnerabilitiesurl:https://www.cnvd.org.cn/patchinfo/show/100859

Trust: 0.6

sources: CNVD: CNVD-2018-12932 // CNVD: CNVD-2017-22848

EXTERNAL IDS

db:BIDid:100483

Trust: 0.9

db:ICS CERTid:ICSA-17-192-05

Trust: 0.9

db:CNVDid:CNVD-2018-12932

Trust: 0.8

db:CNVDid:CNVD-2017-22848

Trust: 0.8

db:IVDid:E2F68B71-39AB-11E9-BCC1-000C29342CB1

Trust: 0.2

db:IVDid:10AD70CB-80CF-4F30-88DC-3F4D437D86FD

Trust: 0.2

sources: IVD: e2f68b71-39ab-11e9-bcc1-000c29342cb1 // IVD: 10ad70cb-80cf-4f30-88dc-3f4d437d86fd // CNVD: CNVD-2018-12932 // CNVD: CNVD-2017-22848 // BID: 100483

REFERENCES

url:https://ics-cert.us-cert.gov/advisories/icsa-17-192-05

Trust: 0.9

url:http://www.securityfocus.com/bid/100483

Trust: 0.6

url:https://www.osisoft.com/default.aspx

Trust: 0.3

url:https://techsupport.osisoft.com/troubleshooting/alerts/al00321

Trust: 0.3

sources: CNVD: CNVD-2018-12932 // CNVD: CNVD-2017-22848 // BID: 100483

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 100483

SOURCES

db:IVDid:e2f68b71-39ab-11e9-bcc1-000c29342cb1
db:IVDid:10ad70cb-80cf-4f30-88dc-3f4d437d86fd
db:CNVDid:CNVD-2018-12932
db:CNVDid:CNVD-2017-22848
db:BIDid:100483

LAST UPDATE DATE

2022-05-17T01:57:39.838000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2018-12932date:2018-07-12T00:00:00
db:CNVDid:CNVD-2017-22848date:2017-08-25T00:00:00
db:BIDid:100483date:2017-07-11T00:00:00

SOURCES RELEASE DATE

db:IVDid:e2f68b71-39ab-11e9-bcc1-000c29342cb1date:2018-07-12T00:00:00
db:IVDid:10ad70cb-80cf-4f30-88dc-3f4d437d86fddate:2017-08-25T00:00:00
db:CNVDid:CNVD-2018-12932date:2017-07-12T00:00:00
db:CNVDid:CNVD-2017-22848date:2017-08-25T00:00:00
db:BIDid:100483date:2017-07-11T00:00:00