Details of VAR-201908-0864

ID

VAR-201908-0864

CVE

CVE-2019-13512

TITLE

Fuji Electric FRENIC Loader Vulnerable to out-of-bounds reading

Trust: 0.8

sources: JVNDB: JVNDB-2019-008326

DESCRIPTION

Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an attacker to read limited information from the device. Fuji Electric FRENIC Loader Contains an out-of-bounds vulnerability.Information may be obtained. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of FN1 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process

Trust: 2.79

sources: NVD: CVE-2019-13512 // JVNDB: JVNDB-2019-008326 // ZDI: ZDI-19-690 // CNVD: CNVD-2019-42768

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-42768

AFFECTED PRODUCTS

vendor:	fujielectric	model:	frenic loader	scope:	lte	version:	3.5.0.0	Trust: 1.0
vendor:	fuji electric	model:	frenic loader	scope:	lte	version:	3.5.0.0	Trust: 0.8
vendor:	fuji electric	model:	frenic loader	scope:	-	version:	-	Trust: 0.7
vendor:	fuji	model:	electric frenic loader	scope:	lte	version:	<=3.5.0.0	Trust: 0.6

sources: ZDI: ZDI-19-690 // CNVD: CNVD-2019-42768 // JVNDB: JVNDB-2019-008326 // NVD: CVE-2019-13512

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-13512
value:	LOW
Trust: 1.0
NVD:	CVE-2019-13512
value:	LOW
Trust: 0.8
ZDI:	CVE-2019-13512
value:	LOW
Trust: 0.7
CNVD:	CNVD-2019-42768
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201908-166
value:	LOW
Trust: 0.6

nvd@nist.gov:	CVE-2019-13512
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2019-42768
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-13512
baseSeverity:	LOW
baseScore:	3.3
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2019-13512
baseSeverity:	LOW
baseScore:	3.3
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2019-13512
baseSeverity:	LOW
baseScore:	3.3
vectorString:	AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	1.4
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-19-690 // CNVD: CNVD-2019-42768 // JVNDB: JVNDB-2019-008326 // CNNVD: CNNVD-201908-166 // NVD: CVE-2019-13512

PROBLEMTYPE DATA

problemtype:

CWE-125

Trust: 1.8

sources: JVNDB: JVNDB-2019-008326 // NVD: CVE-2019-13512

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201908-166

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201908-166

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-008326

PATCH

title:	Top Page	url:	https://www.fujielectric.com/index.html	Trust: 0.8
title:	Fuji Electric has issued an update to correct this vulnerability.	url:	https://www.us-cert.gov/ics/advisories/icsa-19-213-02	Trust: 0.7
title:	Patch for Fuji Electric FRENIC Loader Out-of-bounds Read Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/192441	Trust: 0.6
title:	Fuji Electric FRENIC Loader Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=95925	Trust: 0.6

sources: ZDI: ZDI-19-690 // CNVD: CNVD-2019-42768 // JVNDB: JVNDB-2019-008326 // CNNVD: CNNVD-201908-166

EXTERNAL IDS

db:	NVD	id:	CVE-2019-13512	Trust: 3.7
db:	ICS CERT	id:	ICSA-19-213-02	Trust: 3.0
db:	ZDI	id:	ZDI-19-690	Trust: 1.3
db:	JVNDB	id:	JVNDB-2019-008326	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-7921	Trust: 0.7
db:	CNVD	id:	CNVD-2019-42768	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.2902	Trust: 0.6
db:	CNNVD	id:	CNNVD-201908-166	Trust: 0.6

sources: ZDI: ZDI-19-690 // CNVD: CNVD-2019-42768 // JVNDB: JVNDB-2019-008326 // CNNVD: CNNVD-201908-166 // NVD: CVE-2019-13512

REFERENCES

url:	https://www.us-cert.gov/ics/advisories/icsa-19-213-02	Trust: 3.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-13512	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13512	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2019.2902/	Trust: 0.6
url:	https://www.zerodayinitiative.com/advisories/zdi-19-690/	Trust: 0.6

sources: ZDI: ZDI-19-690 // CNVD: CNVD-2019-42768 // JVNDB: JVNDB-2019-008326 // CNNVD: CNNVD-201908-166 // NVD: CVE-2019-13512

CREDITS

kimiya of 9SG Security Team - kimiya@9sgsec.com

Trust: 1.3

sources: ZDI: ZDI-19-690 // CNNVD: CNNVD-201908-166

SOURCES

db:	ZDI	id:	ZDI-19-690
db:	CNVD	id:	CNVD-2019-42768
db:	JVNDB	id:	JVNDB-2019-008326
db:	CNNVD	id:	CNNVD-201908-166
db:	NVD	id:	CVE-2019-13512

LAST UPDATE DATE

2024-11-23T22:06:06.113000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-19-690	date:	2019-08-05T00:00:00
db:	CNVD	id:	CNVD-2019-42768	date:	2019-11-29T00:00:00
db:	JVNDB	id:	JVNDB-2019-008326	date:	2019-08-29T00:00:00
db:	CNNVD	id:	CNNVD-201908-166	date:	2019-08-27T00:00:00
db:	NVD	id:	CVE-2019-13512	date:	2024-11-21T04:25:02.727

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-19-690	date:	2019-08-05T00:00:00
db:	CNVD	id:	CNVD-2019-42768	date:	2019-11-29T00:00:00
db:	JVNDB	id:	JVNDB-2019-008326	date:	2019-08-29T00:00:00
db:	CNNVD	id:	CNNVD-201908-166	date:	2019-08-01T00:00:00
db:	NVD	id:	CVE-2019-13512	date:	2019-08-15T19:15:11.013