cnvd - cnvd-2019-01681

CNVD-2019-01681

Vulnerability from cnvd - Published: 2019-01-16

Title

Emerson DeltaV Distributed Control System身份验证绕过漏洞

Description

Emerson DeltaV Distributed Control System是美国艾默生电气（Emerson Electric）公司的一套自动化分布式控制系统。该系统包括网络安全管理、报警管理、批量控制和变更管理等功能。 Emerson DeltaV Distributed Control System中存在身份验证绕过漏洞，远程攻击者可利用该漏洞绕过身份验证机制并造成拒绝服务。

Severity

中

Patch Name

Emerson DeltaV Distributed Control System身份验证绕过漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.emerson.com/

Reference

http://www.securityfocus.com/bid/106522

Impacted products

Name
['Emerson Electric DeltaV Distributed Control System 11.3.1', 'Emerson Electric DeltaV Distributed Control System 11.3.2', 'Emerson Electric DeltaV Distributed Control System 12.3.1', 'Emerson Electric DeltaV Distributed Control System 13.3.1', 'Emerson Electric DeltaV Distributed Control System 14.3', 'Emerson Electric DeltaV Distributed Control System R5.1', 'Emerson Electric DeltaV Distributed Control System <=R6']

Name

['Emerson Electric DeltaV Distributed Control System 11.3.1', 'Emerson Electric DeltaV Distributed Control System 11.3.2', 'Emerson Electric DeltaV Distributed Control System 12.3.1', 'Emerson Electric DeltaV Distributed Control System 13.3.1', 'Emerson Electric DeltaV Distributed Control System 14.3', 'Emerson Electric DeltaV Distributed Control System R5.1', 'Emerson Electric DeltaV Distributed Control System <=R6']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "106522"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-19021"
    }
  },
  "description": "Emerson DeltaV Distributed Control System\u662f\u7f8e\u56fd\u827e\u9ed8\u751f\u7535\u6c14\uff08Emerson Electric\uff09\u516c\u53f8\u7684\u4e00\u5957\u81ea\u52a8\u5316\u5206\u5e03\u5f0f\u63a7\u5236\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u62ec\u7f51\u7edc\u5b89\u5168\u7ba1\u7406\u3001\u62a5\u8b66\u7ba1\u7406\u3001\u6279\u91cf\u63a7\u5236\u548c\u53d8\u66f4\u7ba1\u7406\u7b49\u529f\u80fd\u3002\n\nEmerson DeltaV Distributed Control System\u4e2d\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\u5e76\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Alexander Nochvay",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.emerson.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-01681",
  "openTime": "2019-01-16",
  "patchDescription": "Emerson DeltaV Distributed Control System\u662f\u7f8e\u56fd\u827e\u9ed8\u751f\u7535\u6c14\uff08Emerson Electric\uff09\u516c\u53f8\u7684\u4e00\u5957\u81ea\u52a8\u5316\u5206\u5e03\u5f0f\u63a7\u5236\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u62ec\u7f51\u7edc\u5b89\u5168\u7ba1\u7406\u3001\u62a5\u8b66\u7ba1\u7406\u3001\u6279\u91cf\u63a7\u5236\u548c\u53d8\u66f4\u7ba1\u7406\u7b49\u529f\u80fd\u3002\r\n\r\nEmerson DeltaV Distributed Control System\u4e2d\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\u5e76\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Emerson DeltaV Distributed Control System\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Emerson Electric DeltaV Distributed Control System 11.3.1",
      "Emerson Electric DeltaV Distributed Control System 11.3.2",
      "Emerson Electric DeltaV Distributed Control System 12.3.1",
      "Emerson Electric DeltaV Distributed Control System 13.3.1",
      "Emerson Electric DeltaV Distributed Control System 14.3",
      "Emerson Electric DeltaV Distributed Control System R5.1",
      "Emerson Electric DeltaV Distributed Control System \u003c=R6"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/106522",
  "serverity": "\u4e2d",
  "submitTime": "2019-01-15",
  "title": "Emerson DeltaV Distributed Control System\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2018-19021 (GCVE-0-2018-19021)

Vulnerability from cvelistv5 – Published: 2019-01-25 20:00 – Updated: 2024-09-17 03:52

Summary

A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service.

Severity ?

No CVSS data available.

CWE

CWE-307 - Authentication Bypass CWE-307

Assigner

icscert

References

URL

Tags

	http://www.securityfocus.com/bid/106522	vdb-entryx_refsource_BID
	https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Emerson	Emerson DeltaV	Affected: DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:23:08.523Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106522",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106522"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Emerson DeltaV",
          "vendor": "Emerson",
          "versions": [
            {
              "status": "affected",
              "version": "DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior."
            }
          ]
        }
      ],
      "datePublic": "2019-01-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Authentication Bypass CWE-307",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-26T10:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "106522",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106522"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2019-01-10T00:00:00",
          "ID": "CVE-2018-19021",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Emerson DeltaV",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Emerson"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Authentication Bypass CWE-307"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106522",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106522"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-19021",
    "datePublished": "2019-01-25T20:00:00Z",
    "dateReserved": "2018-11-06T00:00:00",
    "dateUpdated": "2024-09-17T03:52:35.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-01681

CVE-2018-19021 (GCVE-0-2018-19021)

Tags

Sightings

Nomenclature