- Synchronized data.

This commit is contained in:
CVE Team 2018-01-18 15:04:24 -05:00
parent f60c9f3d37
commit 5996ec37ab
No known key found for this signature in database
GPG Key ID: 3504EC0FB4B2FE56
8 changed files with 99 additions and 96 deletions

View File

@ -11,96 +11,18 @@
"product" : {
"product_data" : [
{
"product_name" : "Primary Setup Tool (PST), SIMATIC IT Production Suite, SIMATIC NET PC-Software, SIMATIC PCS 7 V7.1, SIMATIC PCS 7 V8.0, SIMATIC PCS 7 V8.1, SIMATIC PCS 7 V8.2, SIMATIC STEP 7 (TIA Portal) V13, SIMATIC STEP 7 V5.X, SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced, SIMATIC WinCC (TIA Portal) Professional V13, SIMATIC WinCC (TIA Portal) Professional V14, SIMATIC WinCC Runtime Professional V13, SIMATIC WinCC Runtime Professional V14, SIMATIC WinCC V7.0 SP2 and earlier versions, SIMATIC WinCC V7.0 SP3, SIMATIC WinCC V7.2, SIMATIC WinCC V7.3, SIMATIC WinCC V7.4, SIMIT V9.0, SINEMA Remote Connect Client, SINEMA Server, SOFTNET Security Client V5.0, Security Configuration Tool (SCT), TeleControl Server Basic, WinAC RTX 2010 SP2, WinAC RTX F 2010 SP2",
"product_name" : "n/a",
"version" : {
"version_data" : [
{
"version_value" : "Primary Setup Tool (PST) : All versions < V4.2 HF1"
},
{
"version_value" : "SIMATIC IT Production Suite : All versions < V7.0 SP1 HFX 2"
},
{
"version_value" : "SIMATIC NET PC-Software : All versions < V14"
},
{
"version_value" : "SIMATIC PCS 7 V7.1 : All versions"
},
{
"version_value" : "SIMATIC PCS 7 V8.0 : All versions"
},
{
"version_value" : "SIMATIC PCS 7 V8.1 : All versions"
},
{
"version_value" : "SIMATIC PCS 7 V8.2 : All versions"
},
{
"version_value" : "SIMATIC STEP 7 (TIA Portal) V13 : All versions < V13 SP2"
},
{
"version_value" : "SIMATIC STEP 7 V5.X : All versions < V5.5 SP4 HF11"
},
{
"version_value" : "SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced : All versions < V14"
},
{
"version_value" : "SIMATIC WinCC (TIA Portal) Professional V13 : All versions < V13 SP2"
},
{
"version_value" : "SIMATIC WinCC (TIA Portal) Professional V14 : All versions < V14 SP1"
},
{
"version_value" : "SIMATIC WinCC Runtime Professional V13 : All versions < V13 SP2"
},
{
"version_value" : "SIMATIC WinCC Runtime Professional V14 : All versions < V14 SP1"
},
{
"version_value" : "SIMATIC WinCC V7.0 SP2 and earlier versions : All versions < V7.0 SP2 Upd 12"
},
{
"version_value" : "SIMATIC WinCC V7.0 SP3 : All versions < V7.0 SP3 Upd 8"
},
{
"version_value" : "SIMATIC WinCC V7.2 : All versions < V7.2 Upd 14"
},
{
"version_value" : "SIMATIC WinCC V7.3 : All versions < V7.3 Upd 11"
},
{
"version_value" : "SIMATIC WinCC V7.4 : All versions < V7.4 SP1"
},
{
"version_value" : "SIMIT V9.0 : All versions < V9.0 SP1"
},
{
"version_value" : "SINEMA Remote Connect Client : All versions < V1.0 SP3"
},
{
"version_value" : "SINEMA Server : All versions < V13 SP2"
},
{
"version_value" : "SOFTNET Security Client V5.0 : All versions"
},
{
"version_value" : "Security Configuration Tool (SCT) : All versions < V4.3 HF1"
},
{
"version_value" : "TeleControl Server Basic : All versions < V3.0 SP2"
},
{
"version_value" : "WinAC RTX 2010 SP2 : All versions"
},
{
"version_value" : "WinAC RTX F 2010 SP2 : All versions"
"version_value" : "n/a"
}
]
}
}
]
},
"vendor_name" : "Siemens AG"
"vendor_name" : "n/a"
}
]
}
@ -122,7 +44,7 @@
"description" : [
{
"lang" : "eng",
"value" : "CWE-284: Improper Access Control"
"value" : "n/a"
}
]
}

View File

@ -1,8 +1,31 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ASSIGNER" : "ics-cert@hq.dhs.gov",
"ID" : "CVE-2017-12729",
"STATE" : "RESERVED"
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "Moxa SoftCMS Live Viewer",
"version" : {
"version_data" : [
{
"version_value" : "Moxa SoftCMS Live Viewer"
}
]
}
}
]
},
"vendor_name" : "n/a"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
@ -11,7 +34,26 @@
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value" : "A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability has been identified. Attackers can exploit this vulnerability to access SoftCMS without knowing the user's password."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "CWE-89"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://ics-cert.us-cert.gov/advisories/ICSA-17-243-05"
}
]
}

View File

@ -148,7 +148,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "A vulnerability has been identified in SIMATIC S7-200 Smart, SIMATIC S7-400 PN V6, SIMATIC S7-400 H V6, SIMATIC S7-400 PN/DP V7, SIMATIC S7-410 V8, SIMATIC S7-300, SIMATIC S7-1200, SIMATIC S7-1500, SIMATIC S7-1500 Software Controller, SIMATIC WinAC RTX 2010 incl. F, SIMATIC ET200AL, SIMATIC ET200ecoPN, SIMATIC ET200M, SIMATIC ET200MP, SIMATIC ET200pro, SIMATIC ET200S, SIMATIC ET200SP, Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 PN IO, SIMOTION D, SIMOTION C, SIMOTION P, SINAMICS DCM, SINAMICS DCP, SINAMICS G110M w. PN, SINAMICS G120 (C/P/D) w. PN, SINAMICS G130 w. PN, SINAMICS G150 w. PN, SINAMICS S110 w. PN, SINAMICS S120 w. PN, SINAMICS S150 V4.7 w. PN, SINAMICS S150 V4.8 w. PN, SINAMICS V90 w. PN, SINUMERIK 840D sl, SIMATIC Compact Field Unit, SIMATIC PN/PN Coupler, SIMOCODE pro V PROFINET, SIRIUS Soft Starter 3RW44 PN. Specially crafted packets sent to port 161/udp could cause a Denial-of-Service condition.The affected devices must be restarted manually."
"value" : "A vulnerability has been identified in SIMATIC S7-200 Smart, SIMATIC S7-400 PN V6, SIMATIC S7-400 H V6, SIMATIC S7-400 PN/DP V7, SIMATIC S7-410 V8, SIMATIC S7-300, SIMATIC S7-1200, SIMATIC S7-1500, SIMATIC S7-1500 Software Controller, SIMATIC WinAC RTX 2010 incl. F, SIMATIC ET200AL, SIMATIC ET200ecoPN, SIMATIC ET200M, SIMATIC ET200MP, SIMATIC ET200pro, SIMATIC ET200S, SIMATIC ET200SP, Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 PN IO, SIMOTION D, SIMOTION C, SIMOTION P, SINAMICS DCM, SINAMICS DCP, SINAMICS G110M w. PN, SINAMICS G120 (C/P/D) w. PN, SINAMICS G130 w. PN, SINAMICS G150 w. PN, SINAMICS S110 w. PN, SINAMICS S120 w. PN, SINAMICS S150 V4.7 w. PN, SINAMICS S150 V4.8 w. PN, SINAMICS V90 w. PN, SINUMERIK 840D sl, SIMATIC Compact Field Unit, SIMATIC PN/PN Coupler, SIMOCODE pro V PROFINET, SIRIUS Soft Starter 3RW44 PN. Specially crafted packets sent to port 161/udp could cause a Denial-of-Service condition. The affected devices must be restarted manually."
}
]
},

View File

@ -53,9 +53,6 @@
},
"references" : {
"reference_data" : [
{
"url" : "https://cwe.mitre.org/data/definitions/79.html"
},
{
"url" : "https://jira.atlassian.com/browse/JRASERVER-66623"
}

View File

@ -315,10 +315,10 @@
"references" : {
"reference_data" : [
{
"url" : "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284673.pdf;"
"url" : "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-293562.pdf"
},
{
"url" : "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-293562.pdf"
"url" : "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284673.pdf"
},
{
"url" : "http://www.securityfocus.com/bid/98369"

View File

@ -271,7 +271,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "A vulnerability has been identified in Development/Evaluation Kit DK Standard Ethernet Controller, Development/Evaluation Kit EK-ERTEC 200 PN IO, Development/Evaluation Kit EK-ERTEC 200P PN IO, IE/AS-i Link PN IO, IE/PB-Link, SCALANCE M-800, S615, SCALANCE W700, SCALANCE X-200, SCALANCE X-200 IRT, SCALANCE X-300/X408, SCALANCE X414, SCALANCE XM400, SCALANCE XR500, SIMATIC WinAC RTX 2010 incl. F, SIMATIC CP 1243-1, SIMATIC CP 1243-1 DNP3, SIMATIC CP 1243-1 IEC, SIMATIC CP 1243-1 IRC, SIMATIC CP 1542-1, SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543-1, SIMATIC CP 1543SP-1, SIMATIC CP 1604, SIMATIC CP 1616, SIMATIC CP 343-1 Adv, SIMATIC CP 343-1 Lean, SIMATIC CP 343-1 Std, SIMATIC CP 443-1 Adv, SIMATIC CP 443-1 OPC-UA, SIMATIC CP 443-1 Std, SIMATIC DK-16xx PN IO, SIMATIC ET 200AL, SIMATIC ET 200M, SIMATIC ET 200MP, SIMATIC ET 200S, SIMATIC ET 200SP, SIMATIC ET 200ecoPN, SIMATIC ET 200pro, SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels, SIMATIC PN/PN Coupler, SIMATIC RF650R, SIMATIC RF680R, SIMATIC RF685R, SIMATIC S7-1200 incl. F, SIMATIC S7-1500 Software Controller incl. F, SIMATIC S7-1500 incl. F, T, and TF, SIMATIC S7-200 SMART, SIMATIC S7-300 incl. F and T, SIMATIC S7-400 PN/DP V6 Incl. F, SIMATIC S7-400 PN/DP V7 Incl. F, SIMATIC S7-400-H V6, SIMATIC S7-410, SIMATIC Teleservice Adapter Standard Modem, IE Basic, IE Advanced, SIMOCODE pro V PROFINET, SIMOTION, SINAMICS DCM w. PN, SINAMICS DCP w. PN, SINAMICS G110M w. PN, SINAMICS G120(C/P/D) w. PN, SINAMICS G130 V4.7 w. PN, SINAMICS G130 V4.8 w. PN, SINAMICS G150 V4.7 w. PN, SINAMICS G150 V4.8 w. PN, SINAMICS S110 w. PN, SINAMICS S120 V4.7 w. PN, SINAMICS S120 V4.8 w. PN, SINAMICS S150 V4.7 w. PN, SINAMICS S150 V4.8 w. PN, SINAMICS V90 w. PN, SINUMERIK 828D V4.5 and prior, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.5 and prior, SINUMERIK 840D sl V4.7, SIRIUS ACT 3SU1 interface module PROFINET, SIRIUS Motor Starter M200D PROFINET, SIRIUS Soft Starter 3RW44 PN, SITOP PSU8600 PROFINET, SITOP UPS1600 PROFINET, Softnet PROFINET IO for PC-based Windows systems. Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a Denial-of-Service condition of that product. Humaninteraction is required to recover the system. PROFIBUS interfaces are not affected. This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile Panels, and S7-300/S7-400 devices."
"value" : "A vulnerability has been identified in Development/Evaluation Kit DK Standard Ethernet Controller, Development/Evaluation Kit EK-ERTEC 200 PN IO, Development/Evaluation Kit EK-ERTEC 200P PN IO, IE/AS-i Link PN IO, IE/PB-Link, SCALANCE M-800, S615, SCALANCE W700, SCALANCE X-200, SCALANCE X-200 IRT, SCALANCE X-300/X408, SCALANCE X414, SCALANCE XM400, SCALANCE XR500, SIMATIC WinAC RTX 2010 incl. F, SIMATIC CP 1243-1, SIMATIC CP 1243-1 DNP3, SIMATIC CP 1243-1 IEC, SIMATIC CP 1243-1 IRC, SIMATIC CP 1542-1, SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543-1, SIMATIC CP 1543SP-1, SIMATIC CP 1604, SIMATIC CP 1616, SIMATIC CP 343-1 Adv, SIMATIC CP 343-1 Lean, SIMATIC CP 343-1 Std, SIMATIC CP 443-1 Adv, SIMATIC CP 443-1 OPC-UA, SIMATIC CP 443-1 Std, SIMATIC DK-16xx PN IO, SIMATIC ET 200AL, SIMATIC ET 200M, SIMATIC ET 200MP, SIMATIC ET 200S, SIMATIC ET 200SP, SIMATIC ET 200ecoPN, SIMATIC ET 200pro, SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels, SIMATIC PN/PN Coupler, SIMATIC RF650R, SIMATIC RF680R, SIMATIC RF685R, SIMATIC S7-1200 incl. F, SIMATIC S7-1500 Software Controller incl. F, SIMATIC S7-1500 incl. F, T, and TF, SIMATIC S7-200 SMART, SIMATIC S7-300 incl. F and T, SIMATIC S7-400 PN/DP V6 Incl. F, SIMATIC S7-400 PN/DP V7 Incl. F, SIMATIC S7-400-H V6, SIMATIC S7-410, SIMATIC Teleservice Adapter Standard Modem, IE Basic, IE Advanced, SIMOCODE pro V PROFINET, SIMOTION, SINAMICS DCM w. PN, SINAMICS DCP w. PN, SINAMICS G110M w. PN, SINAMICS G120(C/P/D) w. PN, SINAMICS G130 V4.7 w. PN, SINAMICS G130 V4.8 w. PN, SINAMICS G150 V4.7 w. PN, SINAMICS G150 V4.8 w. PN, SINAMICS S110 w. PN, SINAMICS S120 V4.7 w. PN, SINAMICS S120 V4.8 w. PN, SINAMICS S150 V4.7 w. PN, SINAMICS S150 V4.8 w. PN, SINAMICS V90 w. PN, SINUMERIK 828D V4.5 and prior, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.5 and prior, SINUMERIK 840D sl V4.7, SIRIUS ACT 3SU1 interface module PROFINET, SIRIUS Motor Starter M200D PROFINET, SIRIUS Soft Starter 3RW44 PN, SITOP PSU8600 PROFINET, SITOP UPS1600 PROFINET, Softnet PROFINET IO for PC-based Windows systems. Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a Denial-of-Service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected. This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile Panels, and S7-300/S7-400 devices."
}
]
},

View File

@ -1,8 +1,31 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ASSIGNER" : "ics-cert@hq.dhs.gov",
"ID" : "CVE-2017-5170",
"STATE" : "RESERVED"
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "Moxa SoftNVR-IA Live Viewer",
"version" : {
"version_data" : [
{
"version_value" : "Moxa SoftNVR-IA Live Viewer"
}
]
}
}
]
},
"vendor_name" : "n/a"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
@ -11,7 +34,26 @@
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value" : "An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path element (DLL Hijacking) vulnerability has been identified. To exploit this vulnerability, an attacker could rename a malicious DLL to meet the criteria of the application, and the application would not verify that the DLL is correct. The attacker needs to have administrative access to the default install location in order to plant the insecure DLL. Once loaded by the application, the DLL could run malicious code at the privilege level of the application."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "CWE-427"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://ics-cert.us-cert.gov/advisories/ICSA-17-220-02"
}
]
}

View File

@ -95,7 +95,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "A vulnerability has been identified in Primary Setup Tool (PST), SIMATIC Automation Tool, SIMATIC NET PC-Software, SIMATIC PCS 7, SIMATIC STEP 7 (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) V14, SIMATIC STEP 7 V5.X, SIMATIC WinAC RTX 2010 SP2, SIMATIC WinAC RTX F 2010 SP2, SIMATIC WinCC (TIA Portal) V13, SIMATIC WinCC (TIA Portal) V14, SIMATIC WinCC V7.2 and prior, SIMATIC WinCC V7.3, SIMATIC WinCC V7.4, SIMATIC WinCC flexible 2008, SINAUT ST7CC, SINEMA Server, SINUMERIK 808D Programming Tool, SMART PC Access, STEP 7 - Micro/WIN SMART, Security Configuration Tool (SCT). Specially crafted PROFINET DCP broadcast packets sent to the affected products on alocal Ethernet segment (Layer 2) could cause a Denial-of-Service condition of someservices. The services require manual restart to recover."
"value" : "A vulnerability has been identified in Primary Setup Tool (PST), SIMATIC Automation Tool, SIMATIC NET PC-Software, SIMATIC PCS 7, SIMATIC STEP 7 (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) V14, SIMATIC STEP 7 V5.X, SIMATIC WinAC RTX 2010 SP2, SIMATIC WinAC RTX F 2010 SP2, SIMATIC WinCC (TIA Portal) V13, SIMATIC WinCC (TIA Portal) V14, SIMATIC WinCC V7.2 and prior, SIMATIC WinCC V7.3, SIMATIC WinCC V7.4, SIMATIC WinCC flexible 2008, SINAUT ST7CC, SINEMA Server, SINUMERIK 808D Programming Tool, SMART PC Access, STEP 7 - Micro/WIN SMART, Security Configuration Tool (SCT). Specially crafted PROFINET DCP broadcast packets sent to the affected products on a local Ethernet segment (Layer 2) could cause a Denial-of-Service condition of some services. The services require manual restart to recover."
}
]
},