cnvd - cnvd-2018-25432

CNVD-2018-25432

Vulnerability from cnvd - Published: 2018-12-14

Title

Siemens SIMATIC Panels和SIMATIC WinCC代码注入漏洞

Description

Siemens SIMATIC Panels和SIMATIC WinCC（TIA Portal）都是德国西门子（Siemens）公司的产品。Siemens SIMATIC Panels是一款人机界面面板。SIMATIC WinCC是一套自动化的数据采集与监控（SCADA）系统。 Siemens SIMATIC Panels和SIMATIC WinCC (TIA Portal)中存在代码注入漏洞，攻击者可借助恶意的链接利用该漏洞注入HTTP包头。

Severity

中

Patch Name

Siemens SIMATIC Panels和SIMATIC WinCC代码注入漏洞的补丁

Patch Description

Formal description

目前厂商只发布了SIMATIC HMI Comfort Panels等产品的升级补丁以修复漏洞，产品SIMATIC HMI Classic Devices的升级补丁暂未发布，详情请参考链接： https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf

Reference

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-03

Impacted products

Name
['Siemens SIMATIC HMI Comfort Panels 4" - 22" <14', 'Siemens SIMATIC HMI Comfort Outdoor Panels 7"和15" <14', 'Siemens SIMATIC HMI KTP Mobile Panels（KTP400F、KTP700、KTP700F、KTP900和KTP900F） <14', 'Siemens SIMATIC WinCC Runtime Advanced <14', 'Siemens SIMATIC WinCC Runtime Professional <14', 'Siemens SIMATIC WinCC (TIA Portal) <14']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-13814"
    }
  },
  "description": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\uff08TIA Portal\uff09\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Siemens SIMATIC Panels\u662f\u4e00\u6b3e\u4eba\u673a\u754c\u9762\u9762\u677f\u3002SIMATIC WinCC\u662f\u4e00\u5957\u81ea\u52a8\u5316\u7684\u6570\u636e\u91c7\u96c6\u4e0e\u76d1\u63a7\uff08SCADA\uff09\u7cfb\u7edf\u3002\n\nSiemens SIMATIC Panels\u548cSIMATIC WinCC (TIA Portal)\u4e2d\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165HTTP\u5305\u5934\u3002",
  "discovererName": "Siemens",
  "formalWay": "\u76ee\u524d\u5382\u5546\u53ea\u53d1\u5e03\u4e86SIMATIC HMI Comfort Panels\u7b49\u4ea7\u54c1\u7684\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u4ea7\u54c1SIMATIC HMI Classic Devices\u7684\u5347\u7ea7\u8865\u4e01\u6682\u672a\u53d1\u5e03\uff0c\u8be6\u60c5\u8bf7\u53c2\u8003\u94fe\u63a5\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-25432",
  "openTime": "2018-12-14",
  "patchDescription": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\uff08TIA Portal\uff09\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Siemens SIMATIC Panels\u662f\u4e00\u6b3e\u4eba\u673a\u754c\u9762\u9762\u677f\u3002SIMATIC WinCC\u662f\u4e00\u5957\u81ea\u52a8\u5316\u7684\u6570\u636e\u91c7\u96c6\u4e0e\u76d1\u63a7\uff08SCADA\uff09\u7cfb\u7edf\u3002\r\n\r\nSiemens SIMATIC Panels\u548cSIMATIC WinCC (TIA Portal)\u4e2d\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165HTTP\u5305\u5934\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SIMATIC HMI Comfort Panels 4\" - 22\" \u003c14",
      "Siemens SIMATIC HMI Comfort Outdoor Panels 7\"\u548c15\" \u003c14",
      "Siemens SIMATIC HMI KTP Mobile Panels\uff08KTP400F\u3001KTP700\u3001KTP700F\u3001KTP900\u548cKTP900F\uff09 \u003c14",
      "Siemens SIMATIC WinCC Runtime Advanced \u003c14",
      "Siemens SIMATIC WinCC Runtime Professional \u003c14",
      "Siemens SIMATIC WinCC (TIA Portal) \u003c14"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-18-317-03",
  "serverity": "\u4e2d",
  "submitTime": "2018-11-16",
  "title": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2018-13814 (GCVE-0-2018-13814)

Vulnerability from cvelistv5 – Published: 2018-12-13 16:00 – Updated: 2024-08-05 09:14

Summary

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V14), SIMATIC WinCC Runtime Advanced (All versions < V14), SIMATIC WinCC Runtime Professional (All versions < V14), SIMATIC WinCC (TIA Portal) (All versions < V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

Severity ?

No CVSS data available.

CWE

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Assigner

siemens

References

URL

Tags

	http://www.securityfocus.com/bid/105931	vdb-entryx_refsource_BID
	https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Siemens AG	SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)	Affected: SIMATIC HMI Comfort Panels 4" - 22" : All versions < V14 Affected: SIMATIC HMI Comfort Outdoor Panels 7" & 15" : All versions < V14 Affected: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions < V14 Affected: SIMATIC WinCC Runtime Advanced : All versions < V14 Affected: SIMATIC WinCC Runtime Professional : All versions < V14 Affected: SIMATIC WinCC (TIA Portal) : All versions < V14 Affected: SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:14:47.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105931",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105931"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SIMATIC HMI Comfort Panels 4\" - 22\", SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "SIMATIC HMI Comfort Panels 4\" - 22\" : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC Runtime Advanced : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC Runtime Professional : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC (TIA Portal) : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions"
            }
          ]
        }
      ],
      "datePublic": "2018-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SIMATIC HMI Comfort Panels 4\" - 22\" (All versions \u003c V14), SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" (All versions \u003c V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions \u003c V14), SIMATIC WinCC Runtime Advanced (All versions \u003c V14), SIMATIC WinCC Runtime Professional (All versions \u003c V14), SIMATIC WinCC (TIA Portal) (All versions \u003c V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-14T10:57:02",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "name": "105931",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105931"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2018-13814",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SIMATIC HMI Comfort Panels 4\" - 22\", SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "SIMATIC HMI Comfort Panels 4\" - 22\" : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC WinCC Runtime Advanced : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC WinCC Runtime Professional : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC WinCC (TIA Portal) : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens AG"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SIMATIC HMI Comfort Panels 4\" - 22\" (All versions \u003c V14), SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" (All versions \u003c V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions \u003c V14), SIMATIC WinCC Runtime Advanced (All versions \u003c V14), SIMATIC WinCC Runtime Professional (All versions \u003c V14), SIMATIC WinCC (TIA Portal) (All versions \u003c V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105931",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105931"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2018-13814",
    "datePublished": "2018-12-13T16:00:00",
    "dateReserved": "2018-07-10T00:00:00",
    "dateUpdated": "2024-08-05T09:14:47.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-25432

CVE-2018-13814 (GCVE-0-2018-13814)

Tags

Sightings

Nomenclature