Vulnerability-Lookup

ICSA-17-208-01

Vulnerability from csaf_cisa - Published: 2017-07-27 00:00 - Updated: 2017-07-27 00:00

Summary

Continental AG Infineon S-Gold 2 (PMB 8876)

Notes

CISA Disclaimer: This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation: ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available.

Countries/areas deployed: Worldwide

Company headquarters location: Germany

Recommended Practices: ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices: Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.

Recommended Practices: Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.

CVE-2017-9647

6.8 (Medium)


                        
                          CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Known affected 14 products

Product	Version	Remediation
BMW: several models produced between 2009-2010 Continental AG / BMW	2009-2010	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 Q70 Continental AG / Infiniti Q70	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2015 QX50 Continental AG / Infiniti QX50	2014-2015	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 QX 80 Continental AG / Infiniti QX80	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2015 QX50 Hybrid Continental AG / Infiniti QX50 Hybrid	2014-2015	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Ford: - program to update 2G modems has been active since 2016 and impact is restricted to the limited number of P-HEV vehicles equipped with this older technology that remain in service Continental AG / Ford	program to update 2G modems has been active since 2016 and impact is restricted to the limited number of P-HEV vehicles equipped with this older technology that remain in service	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 QX60 Continental AG / Infiniti QX60	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2013 JX35 Continental AG / Infiniti JX35	2013	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2013 QX56 Continental AG / Infiniti QX56	2013	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 Q70L Continental AG / Infiniti Q70L	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2013 M37/M56 Continental AG / Infiniti M37/M56	2013	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 QX60 Hybrid Continental AG / Infiniti QX60 Hybrid	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2015-2016 Q70 Hybrid Continental AG / Infiniti Q70 Hybrid	2015-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Nissan: 2011-2015 Leaf Continental AG / Nissian Leaf	2011-2015	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation

CVE-2017-9633

8.8 (High)


                        
                          CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Known affected 14 products

Product	Version	Remediation
BMW: several models produced between 2009-2010 Continental AG / BMW	2009-2010	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 Q70 Continental AG / Infiniti Q70	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2015 QX50 Continental AG / Infiniti QX50	2014-2015	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 QX 80 Continental AG / Infiniti QX80	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2015 QX50 Hybrid Continental AG / Infiniti QX50 Hybrid	2014-2015	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Ford: - program to update 2G modems has been active since 2016 and impact is restricted to the limited number of P-HEV vehicles equipped with this older technology that remain in service Continental AG / Ford	program to update 2G modems has been active since 2016 and impact is restricted to the limited number of P-HEV vehicles equipped with this older technology that remain in service	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 QX60 Continental AG / Infiniti QX60	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2013 JX35 Continental AG / Infiniti JX35	2013	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2013 QX56 Continental AG / Infiniti QX56	2013	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 Q70L Continental AG / Infiniti Q70L	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2013 M37/M56 Continental AG / Infiniti M37/M56	2013	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2014-2016 QX60 Hybrid Continental AG / Infiniti QX60 Hybrid	2014-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Infiniti: 2015-2016 Q70 Hybrid Continental AG / Infiniti Q70 Hybrid	2015-2016	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation
Nissan: 2011-2015 Leaf Continental AG / Nissian Leaf	2011-2015	Mitigation Vendor Fix Vendor Fix Mitigation Mitigation

References

6 references

URL	Category
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://www.cisa.gov/news-events/ics-advisories/i…	self
http://web.nvd.nist.gov/view/vuln/detail?vulnId=C…	external
https://www.first.org/cvss/calculator/3.0#CVSS:3.…	external
http://web.nvd.nist.gov/view/vuln/detail?vulnId=C…	external
https://www.first.org/cvss/calculator/3.0#CVSS:3.…	external

Acknowledgments

Advanced Threat Research Team at McAfee Mickey Shkatov Jesse Michael Oleksandr Bazhaniuk

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Mickey Shkatov",
          "Jesse Michael",
          "Oleksandr Bazhaniuk"
        ],
        "organization": "Advanced Threat Research Team at McAfee",
        "summary": "reporting the vulnerabilities"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-208-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-208-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-208-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-208-01"
      }
    ],
    "title": "Continental AG Infineon S-Gold 2 (PMB 8876)",
    "tracking": {
      "current_release_date": "2017-07-27T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-17-208-01",
      "initial_release_date": "2017-07-27T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2017-07-27T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-17-208-01 Continental AG Infineon S-Gold 2 (PMB 8876)"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2009-2010",
                "product": {
                  "name": "BMW: several models produced between 2009-2010",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "BMW"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2014-2016 ",
                "product": {
                  "name": "Infiniti: 2014-2016 Q70",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti Q70"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2014-2015 ",
                "product": {
                  "name": "Infiniti: 2014-2015 QX50",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti QX50"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2014-2016 ",
                "product": {
                  "name": "Infiniti: 2014-2016 QX 80",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti QX80"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2014-2015 ",
                "product": {
                  "name": "Infiniti: 2014-2015 QX50 Hybrid",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti QX50 Hybrid"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "program to update 2G modems has been active since 2016 and impact is restricted to the limited number of P-HEV vehicles equipped with this older technology that remain in service",
                "product": {
                  "name": "Ford: - program to update 2G modems has been active since 2016 and impact is restricted to the limited number of P-HEV vehicles equipped with this older technology that remain in service",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "Ford"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2014-2016 ",
                "product": {
                  "name": "Infiniti: 2014-2016 QX60",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti QX60"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2013",
                "product": {
                  "name": "Infiniti: 2013 JX35",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti JX35"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2013",
                "product": {
                  "name": "Infiniti: 2013 QX56",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti QX56"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2014-2016 ",
                "product": {
                  "name": "Infiniti: 2014-2016 Q70L",
                  "product_id": "CSAFPID-00010"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti Q70L"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2013",
                "product": {
                  "name": "Infiniti: 2013 M37/M56",
                  "product_id": "CSAFPID-00011"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti M37/M56"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2014-2016 ",
                "product": {
                  "name": "Infiniti: 2014-2016 QX60 Hybrid",
                  "product_id": "CSAFPID-00012"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti QX60 Hybrid"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2015-2016 ",
                "product": {
                  "name": "Infiniti: 2015-2016 Q70 Hybrid",
                  "product_id": "CSAFPID-00013"
                }
              }
            ],
            "category": "product_name",
            "name": "Infiniti Q70 Hybrid"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2011-2015",
                "product": {
                  "name": "Nissan: 2011-2015 Leaf",
                  "product_id": "CSAFPID-00014"
                }
              }
            ],
            "category": "product_name",
            "name": "Nissian Leaf"
          }
        ],
        "category": "vendor",
        "name": "Continental AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-9647",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU.CVE-2017-9647 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been assigned; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-00010",
          "CSAFPID-00011",
          "CSAFPID-00012",
          "CSAFPID-00013",
          "CSAFPID-00014"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9647"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Continental has validated the reported vulnerabilities but has not yet identified a mitigation plan.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Nissan and Infiniti have issued Technical Service Bulletins (TSB) asking dealers to advise customers of the issue and offer a free 2G TCU deactivation. Nissan/Infiniti\u0027s 2G cellular service provider no longer provides 2G services in the U.S. The subject 2G TCUs are no longer connected to telematics services and no longer perform any function in the affected vehicles. Nissan/Infiniti have stated that this campaign is being performed out of abundance of caution to help safeguard against potential cybersecurity issues.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Nissan/Infiniti proposes that users contact their local Infiniti or Nissan dealers to have the subject 2G TCUs deactivated free of charge.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "mitigation",
          "details": "BMW has validated the vulnerabilities and will be offering a service measure to affected customers.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ford, since 2016, has had a customer satisfaction program to update or disable legacy 2G modems and there are a limited number of vehicles left on the market. Ford is reviewing the researcher\u0027s findings through internal processes and evaluating the need for any additional steps.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-9633",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU.CVE-2017-9633 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-00010",
          "CSAFPID-00011",
          "CSAFPID-00012",
          "CSAFPID-00013",
          "CSAFPID-00014"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9633"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Continental has validated the reported vulnerabilities but has not yet identified a mitigation plan.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Nissan and Infiniti have issued Technical Service Bulletins (TSB) asking dealers to advise customers of the issue and offer a free 2G TCU deactivation. Nissan/Infiniti\u0027s 2G cellular service provider no longer provides 2G services in the U.S. The subject 2G TCUs are no longer connected to telematics services and no longer perform any function in the affected vehicles. Nissan/Infiniti have stated that this campaign is being performed out of abundance of caution to help safeguard against potential cybersecurity issues.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Nissan/Infiniti proposes that users contact their local Infiniti or Nissan dealers to have the subject 2G TCUs deactivated free of charge.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "mitigation",
          "details": "BMW has validated the vulnerabilities and will be offering a service measure to affected customers.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ford, since 2016, has had a customer satisfaction program to update or disable legacy 2G modems and there are a limited number of vehicles left on the market. Ford is reviewing the researcher\u0027s findings through internal processes and evaluating the need for any additional steps.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014"
          ]
        }
      ]
    }
  ]
}

CVE-2017-9633 (GCVE-0-2017-9633)

Vulnerability from cvelistv5 – Published: 2017-08-07 08:00 – Updated: 2025-05-06 14:56

Summary

An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-119

Assigner

icscert

References

2 references

URL	Tags
http://www.securityfocus.com/bid/100132	vdb-entryx_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Continental AG Infineon S-Gold 2 (PMB 8876)	Affected: Continental AG Infineon S-Gold 2 (PMB 8876)

Date Public

2017-08-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:11:02.415Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "100132",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100132"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2017-9633",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:32:51.513984Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-06T14:56:50.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Continental AG Infineon S-Gold 2 (PMB 8876)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Continental AG Infineon S-Gold 2 (PMB 8876)"
            }
          ]
        }
      ],
      "datePublic": "2017-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T09:57:02.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "100132",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100132"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-9633",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Continental AG Infineon S-Gold 2 (PMB 8876)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Continental AG Infineon S-Gold 2 (PMB 8876)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "100132",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100132"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2017-9633",
    "datePublished": "2017-08-07T08:00:00.000Z",
    "dateReserved": "2017-06-14T00:00:00.000Z",
    "dateUpdated": "2025-05-06T14:56:50.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-9647 (GCVE-0-2017-9647)

Vulnerability from cvelistv5 – Published: 2017-08-07 08:00 – Updated: 2024-08-05 17:18

Summary

A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU.

Severity

No CVSS data available.

CWE

CWE-121

Assigner

icscert

References

2 references

URL	Tags
http://www.securityfocus.com/bid/100132	vdb-entryx_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Continental AG Infineon S-Gold 2 (PMB 8876)	Affected: Continental AG Infineon S-Gold 2 (PMB 8876)

Date Public

2017-08-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:18:00.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "100132",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100132"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Continental AG Infineon S-Gold 2 (PMB 8876)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Continental AG Infineon S-Gold 2 (PMB 8876)"
            }
          ]
        }
      ],
      "datePublic": "2017-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T09:57:02.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "100132",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100132"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-9647",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Continental AG Infineon S-Gold 2 (PMB 8876)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Continental AG Infineon S-Gold 2 (PMB 8876)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-121"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "100132",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100132"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-208-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2017-9647",
    "datePublished": "2017-08-07T08:00:00.000Z",
    "dateReserved": "2017-06-14T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:18:00.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ICSA-17-208-01

CVE-2017-9633 (GCVE-0-2017-9633)

CVE-2017-9647 (GCVE-0-2017-9647)

Tags

Sightings

Nomenclature