Vulnerability-Lookup

CNVD-2018-06288

Vulnerability from cnvd - Published: 2018-03-26

Title

Beckhoff TwinCAT不可信指针引用漏洞

Description

Beckhoff TwinCAT系统软件可通过多PLC系统、NC轴控制系统、编程环境和操作站，将任何兼容 PC“改造”成为一台实时控制器，可取代传统的 PLC 和 NC/CNC 控制器以及操作设备。 TwinCAT存在不可信指针引用漏洞。由于该程序缺少对用户提供的指针值的正确验证，攻击者利用漏洞可以提升对系统的访问权限。

Severity

高

Patch Name

Beckhoff TwinCAT不可信指针引用漏洞的补丁

Patch Description

Formal description

用户可联系供应商获得补丁信息： https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf

Reference

https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf

Impacted products

Name
['Beckhoff TwinCAT <=3.1 Build 4022.4', 'Beckhoff TwinCAT <=2.11 R3 2259', 'Beckhoff TwinCAT 3.1 C ++/Matlab（TC1210/TC1220/TC1300/TC1320）']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-7502"
    }
  },
  "description": "Beckhoff TwinCAT\u7cfb\u7edf\u8f6f\u4ef6\u53ef\u901a\u8fc7\u591aPLC\u7cfb\u7edf\u3001NC\u8f74\u63a7\u5236\u7cfb\u7edf\u3001\u7f16\u7a0b\u73af\u5883\u548c\u64cd\u4f5c\u7ad9\uff0c\u5c06\u4efb\u4f55\u517c\u5bb9 PC\u201c\u6539\u9020\u201d\u6210\u4e3a\u4e00\u53f0\u5b9e\u65f6\u63a7\u5236\u5668\uff0c\u53ef\u53d6\u4ee3\u4f20\u7edf\u7684 PLC \u548c NC/CNC \u63a7\u5236\u5668\u4ee5\u53ca\u64cd\u4f5c\u8bbe\u5907\u3002\r\n\r\nTwinCAT\u5b58\u5728\u4e0d\u53ef\u4fe1\u6307\u9488\u5f15\u7528\u6f0f\u6d1e\u3002\u7531\u4e8e\u8be5\u7a0b\u5e8f\u7f3a\u5c11\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u6307\u9488\u503c\u7684\u6b63\u786e\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u53ef\u4ee5\u63d0\u5347\u5bf9\u7cfb\u7edf\u7684\u8bbf\u95ee\u6743\u9650\u3002",
  "discovererName": "Steven Seeley",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-06288",
  "openTime": "2018-03-26",
  "patchDescription": "Beckhoff TwinCAT\u7cfb\u7edf\u8f6f\u4ef6\u53ef\u901a\u8fc7\u591aPLC\u7cfb\u7edf\u3001NC\u8f74\u63a7\u5236\u7cfb\u7edf\u3001\u7f16\u7a0b\u73af\u5883\u548c\u64cd\u4f5c\u7ad9\uff0c\u5c06\u4efb\u4f55\u517c\u5bb9 PC\u201c\u6539\u9020\u201d\u6210\u4e3a\u4e00\u53f0\u5b9e\u65f6\u63a7\u5236\u5668\uff0c\u53ef\u53d6\u4ee3\u4f20\u7edf\u7684 PLC \u548c NC/CNC \u63a7\u5236\u5668\u4ee5\u53ca\u64cd\u4f5c\u8bbe\u5907\u3002\r\n\r\nTwinCAT\u5b58\u5728\u4e0d\u53ef\u4fe1\u6307\u9488\u5f15\u7528\u6f0f\u6d1e\u3002\u7531\u4e8e\u8be5\u7a0b\u5e8f\u7f3a\u5c11\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u6307\u9488\u503c\u7684\u6b63\u786e\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u53ef\u4ee5\u63d0\u5347\u5bf9\u7cfb\u7edf\u7684\u8bbf\u95ee\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Beckhoff TwinCAT\u4e0d\u53ef\u4fe1\u6307\u9488\u5f15\u7528\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Beckhoff TwinCAT \u003c=3.1 Build 4022.4",
      "Beckhoff TwinCAT \u003c=2.11 R3 2259",
      "Beckhoff TwinCAT 3.1 C ++/Matlab\uff08TC1210/TC1220/TC1300/TC1320\uff09"
    ]
  },
  "referenceLink": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2018-03-26",
  "title": "Beckhoff TwinCAT\u4e0d\u53ef\u4fe1\u6307\u9488\u5f15\u7528\u6f0f\u6d1e"
}

CVE-2018-7502 (GCVE-0-2018-7502)

Vulnerability from cvelistv5 – Published: 2018-03-23 17:00 – Updated: 2024-09-16 17:14

Summary

Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges.

Severity

No CVSS data available.

CWE

CWE-822 - Untrusted Pointer Dereference CWE-822

Assigner

icscert icscert root

References

4 references

URL	Tags
https://srcincite.io/advisories/src-2018-0007/	x_refsource_MISC
http://www.securityfocus.com/bid/103487	vdb-entryx_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02	x_refsource_MISC
https://download.beckhoff.com/download/Document/p…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
ICS-CERT	Beckhoff TwinCAT PLC products	Affected: TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, TwinCAT 3.1

Date Public

2018-03-22 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:04.349Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://srcincite.io/advisories/src-2018-0007/"
          },
          {
            "name": "103487",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103487"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Beckhoff TwinCAT PLC products",
          "vendor": "ICS-CERT",
          "versions": [
            {
              "status": "affected",
              "version": "TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, TwinCAT 3.1"
            }
          ]
        }
      ],
      "datePublic": "2018-03-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-822",
              "description": "Untrusted Pointer Dereference CWE-822",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-22T19:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://srcincite.io/advisories/src-2018-0007/"
        },
        {
          "name": "103487",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103487"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-03-22T00:00:00",
          "ID": "CVE-2018-7502",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Beckhoff TwinCAT PLC products",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, TwinCAT 3.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ICS-CERT"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Untrusted Pointer Dereference CWE-822"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://srcincite.io/advisories/src-2018-0007/",
              "refsource": "MISC",
              "url": "https://srcincite.io/advisories/src-2018-0007/"
            },
            {
              "name": "103487",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103487"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02"
            },
            {
              "name": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf",
              "refsource": "CONFIRM",
              "url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-7502",
    "datePublished": "2018-03-23T17:00:00.000Z",
    "dateReserved": "2018-02-26T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:14:23.452Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.