var-201409-0445
Vulnerability from variot
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter. Advantech WebAccess is an IE-based HMI/SCADA monitoring software that features all engineering projects, database setup, drawing and software management using a standard browser over the internet or intranet. A buffer overflow vulnerability exists in Advantech WebAccess. An attacker exploits a vulnerability to execute arbitrary code in the context of an affected application or to crash the entire application. Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will likely cause a denial-of-service condition. Advantech WebAccess 7.2 is vulnerable; other versions may also be affected. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/
Advantech WebAccess Vulnerabilities
-
Advisory Information
Title: Advantech WebAccess Vulnerabilities Advisory ID: CORE-2014-0005 Advisory URL: http://www.coresecurity.com/advisories/advantech-webaccess-vulnerabilities Date published: 2014-09-02 Date of last update: 2014-09-01 Vendors contacted: Advantech Release mode: User release
-
Vulnerability Description
Advantech WebAccess [1] is a browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA.
-
WebAccess 7.2 .
-
Non-vulnerable packages
. AdvantechWebAccessUSANode_20140730_3.4.3
-
Vendor Information, Solutions and Workarounds
Advantech has addressed the vulnerability in WebAccess by issuing an update located at http://webaccess.advantech.com/downloads_software.php
Given that this is a client-side vulnerability, affected users should avoid opening untrusted '.html' files. Core Security also recommends those affected use third party software such as Sentinel [4] or EMET [3] that could help to prevent the exploitation of affected systems to some extent.
-
Credits
This vulnerability was discovered and researched by Ricardo Narvaja from Core Security Exploit Writers Team.
Core Security Advisories Team would also like to thank ICS-CERT Coordination Center for their assistance during the vulnerability reporting process.
-
Below is shown the result of opening a malicious html file with a long NodeName parameter, an attacker can overflow the stack buffer mentioned above and overwrite the SEH (Structured Exception Handler), enabling arbitrary code execution on the machine.
/-----
EAX 03A39942 ASCII "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB..." ECX 0162B720 EDX 01630000 xpsp2res.01630000 EBX 0162B720 ESP 0162B454 EBP 0162B460 ESI 0162B4D8 EDI 03A31E98 EIP 064EA6D4 webvact.064EA6D4
-----/
/-----
SEH chain of thread 000016CC Address SE handler 0162DB40 42424242
-----/
-
Report Timeline . 2014-05-06: Core Security notifies Advantech of the vulnerability. Publication date is set for May 26th, 2014. 2014-05-09: CORE asks for a reply. 2014-05-26: First release date missed. 2014-05-26: Core Security notifies that the issues were reported 2 weeks ago and there was no reply since May 6th, 2014. 2014-05-29: Core Security contacts the ICS-CERT for assistance in order to coordinate the disclosure of the advisory. 2014-05-29: ICS-CERT acknowledges Core Security e-mail, and asks for a technical description of the vulnerability. 2014-05-29: Core Security sends technical details to the ICS-CERT. 2014-06-05: ICS-CERT team notifies that they have contacted the vendor and that they will notify us once the vendor has validated the vulnerabilities. 2014-06-18: ICS-CERT team notifies that the vendor is working in a new release, expected to be released in September, and ask if Core Security is interested in validating Advantech's vulnerability fix in their beta version. 2014-06-18: Core Security accepts the testing of the vendor beta version, but shares their concerns about waiting several months for fixes that are related to vulnerabilities already public. 2014-06-18: ICS-CERT notifies that they will let us know when they plan to make the beta version available for testing. 2014-07-03: ICS-CERT team notifies that the vendor is working to provide a download link for the beta version. 2014-07-08: ICS-CERT team sends download link provided by the vendor. 2014-07-10: Core Security confirms to ICS-CERT that the new version it's still vulnerable, and comments that after some analysis the vulnerable function doesn't has changes. 2014-07-10: ICS-CERT notifies that they will let the vendor know that that the vulnerabilities still exist. And asks to setup a teleconference between Core Security, the CERT and the vendor. 2014-07-10: Core Security notifies the ICS-CERT that all interactions are made via email only. 2014-07-10: ICS-CERT notifies they provided the information to the vendor. 2014-07-21: Core Security notifies the ICS-CERT that Tipping Point Zero Day Initiative has released several advisories[2] affecting the vendor including some that appears to be related to the one we are coordinating. 2014-07-21: ICS-CERT notifies that some of those advisories where in coordination with them, and that after a review of the link shared by Core Security are related to ICSA-14-198-02 and don't appear to be related to the reported vulnerability. 2014-07-21: Core Security notifies that ZDI-14-243 and ZDI-14-244 appears to be directly related. 2014-07-21: ICS-CERT is trying to contact Advantech to get a status update and their current plan for vulnerability remediation. 2014-08-07: ICS-CERT notifies that they contacted the vendor and they are waiting for an status update. 2014-08-21: Core Security contacts ICS-CERT since no reply was received in the past two weeks. 2014-08-21: ICS-CERT notifies that vendor representative stated that they are currently training a new product manager and they have not yet responded to the vulnerabilities we are discussing. 2014-08-28: Core Security notifies the ICS-CERT that the advisory publication is going to be scheduled for Monday 1st of September. 2014-08-28: ICS-CERT acknowledges Core Security e-mail. 2014-08-28: Core Security re-schedules the advisory publication for Sep 2nd, 2014. 2014-09-02: Core Security found out that the vendor released a silent fix on 30th of July. 2014-09-02: Core Security releases the advisory CORE-2014-0005 tagged as user-release.
-
References
[1] http://webaccess.advantech.com/. [2] http://www.zerodayinitiative.com/advisories/published/. [3] http://support.microsoft.com/kb/2458544. [4] https://github.com/CoreSecurity/sentinel.
-
About CoreLabs
CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
-
About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
-
Disclaimer
The contents of this advisory are copyright (c) 2014 Core Security and (c) 2014 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
-
PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0445",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "webaccess",
"scope": "eq",
"trust": 3.0,
"vendor": "advantech",
"version": "7.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "advantech webaccess",
"version": "7.2"
}
],
"sources": [
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:advantech:advantech_webaccess:7.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0991"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ricardo Narvaja",
"sources": [
{
"db": "BID",
"id": "69536"
}
],
"trust": 0.3
},
"cve": "CVE-2014-0991",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2014-0991",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-05417",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-68484",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-0991",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2014-05417",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-738",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-68484",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "VULHUB",
"id": "VHN-68484"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the projectname parameter. Advantech WebAccess is an IE-based HMI/SCADA monitoring software that features all engineering projects, database setup, drawing and software management using a standard browser over the internet or intranet. A buffer overflow vulnerability exists in Advantech WebAccess. An attacker exploits a vulnerability to execute arbitrary code in the context of an affected application or to crash the entire application. Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will likely cause a denial-of-service condition. \nAdvantech WebAccess 7.2 is vulnerable; other versions may also be affected. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment. Core Security - Corelabs Advisory\nhttp://corelabs.coresecurity.com/\n\nAdvantech WebAccess Vulnerabilities\n\n\n1. *Advisory Information*\n\n Title: Advantech WebAccess Vulnerabilities\n Advisory ID: CORE-2014-0005\n Advisory URL:\nhttp://www.coresecurity.com/advisories/advantech-webaccess-vulnerabilities\n Date published: 2014-09-02\n Date of last update: 2014-09-01\n Vendors contacted: Advantech\n Release mode: User release\n\n\n2. *Vulnerability Description*\n\n Advantech WebAccess [1] is a browser-based\n software package for human-machine interfaces HMI, and supervisory\n control and data acquisition SCADA. \n\n\n4. WebAccess 7.2\n . \n\n\n5. *Non-vulnerable packages*\n\n . AdvantechWebAccessUSANode_20140730_3.4.3\n\n\n6. *Vendor Information, Solutions and Workarounds*\n\n Advantech has addressed the vulnerability in WebAccess by issuing an\nupdate located at\n http://webaccess.advantech.com/downloads_software.php\n\n Given that this is a client-side vulnerability, affected users\nshould avoid\n opening untrusted \u0027.html\u0027 files. \n Core Security also recommends those affected use third party\nsoftware such as\n Sentinel [4] or EMET [3]\n that could help to prevent the exploitation of affected systems to\nsome extent. \n\n\n7. *Credits*\n\n This vulnerability was discovered and researched by Ricardo Narvaja\nfrom\n Core Security Exploit Writers Team. \n \n Core Security Advisories Team would also like to thank ICS-CERT\nCoordination Center\n for their assistance during the vulnerability reporting process. \n \n\n8. \n\n Below is shown the result of opening a malicious html file with a long\n NodeName parameter, an attacker can overflow the stack buffer mentioned\n above and overwrite the SEH (Structured Exception Handler), enabling\n arbitrary code execution on the machine. \n\n/-----\n \nEAX 03A39942 ASCII \"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB...\"\nECX 0162B720\nEDX 01630000 xpsp2res.01630000\nEBX 0162B720\nESP 0162B454\nEBP 0162B460\nESI 0162B4D8\nEDI 03A31E98\nEIP 064EA6D4 webvact.064EA6D4\n\n-----/\n\n\n/-----\n \nSEH chain of thread 000016CC\nAddress SE handler\n0162DB40 42424242\n\n-----/\n\n\n9. *Report Timeline*\n . 2014-05-06: Core Security notifies Advantech of the vulnerability. \nPublication date is set for May 26th, 2014. 2014-05-09: CORE asks for a reply. 2014-05-26: First release date missed. 2014-05-26: Core Security notifies that the issues were reported 2\nweeks ago and there was no reply since May 6th, 2014. 2014-05-29: Core Security contacts the ICS-CERT for assistance in\norder to coordinate the disclosure of the advisory. 2014-05-29: ICS-CERT acknowledges Core Security e-mail, and asks\nfor a technical description of the vulnerability. 2014-05-29: Core Security sends technical details to the ICS-CERT. 2014-06-05: ICS-CERT team notifies that they have contacted the\nvendor and that they will notify us once the vendor has validated the\nvulnerabilities. 2014-06-18: ICS-CERT team notifies that the vendor is working in a\nnew release, expected to be released in September, and ask if Core\nSecurity is interested in validating Advantech\u0027s vulnerability fix in\ntheir beta version. 2014-06-18: Core Security accepts the testing of the vendor beta\nversion, but shares their concerns about waiting several months for\nfixes that are related to vulnerabilities already public. 2014-06-18: ICS-CERT notifies that they will let us know when they\nplan to make the beta version available for testing. 2014-07-03: ICS-CERT team notifies that the vendor is working to\nprovide a download link for the beta version. 2014-07-08: ICS-CERT team sends download link provided by the vendor. 2014-07-10: Core Security confirms to ICS-CERT that the new\nversion it\u0027s still vulnerable, and comments that after some analysis the\nvulnerable function doesn\u0027t has changes. 2014-07-10: ICS-CERT notifies that they will let the vendor know\nthat that the vulnerabilities still exist. And asks to setup a\nteleconference between Core Security, the CERT and the vendor. 2014-07-10: Core Security notifies the ICS-CERT that all\ninteractions are made via email only. 2014-07-10: ICS-CERT notifies they provided the information to the\nvendor. 2014-07-21: Core Security notifies the ICS-CERT that Tipping Point\nZero Day Initiative has released several advisories[2] affecting the\nvendor including some that appears to be related to the one we are\ncoordinating. 2014-07-21: ICS-CERT notifies that some of those advisories where\nin coordination with them, and that after a review of the link shared by\nCore Security are related to ICSA-14-198-02 and don\u0027t appear to be\nrelated to the reported vulnerability. 2014-07-21: Core Security notifies that ZDI-14-243 and ZDI-14-244\nappears to be directly related. 2014-07-21: ICS-CERT is trying to contact Advantech to get a\nstatus update and their current plan for vulnerability remediation. 2014-08-07: ICS-CERT notifies that they contacted the vendor and\nthey are waiting for an status update. 2014-08-21: Core Security contacts ICS-CERT since no reply was\nreceived in the past two weeks. 2014-08-21: ICS-CERT notifies that vendor representative stated\nthat they are currently training a new product manager and they have not\nyet responded to the vulnerabilities we are discussing. 2014-08-28: Core Security notifies the ICS-CERT that the advisory\npublication is going to be scheduled for Monday 1st of September. 2014-08-28: ICS-CERT acknowledges Core Security e-mail. 2014-08-28: Core Security re-schedules the advisory publication\nfor Sep 2nd, 2014. 2014-09-02: Core Security found out that the vendor released a\nsilent fix on 30th of July. 2014-09-02: Core Security releases the advisory CORE-2014-0005\ntagged as user-release. \n\n\n10. *References*\n\n [1] http://webaccess.advantech.com/. \n [2] http://www.zerodayinitiative.com/advisories/published/. \n [3] http://support.microsoft.com/kb/2458544. \n [4] https://github.com/CoreSecurity/sentinel. \n\n\n11. *About CoreLabs*\n\n CoreLabs, the research center of Core Security, is charged with\nanticipating\n the future needs and requirements for information security\ntechnologies. \n We conduct our research in several important areas of computer security\n including system vulnerabilities, cyber attack planning and simulation,\n source code auditing, and cryptography. Our results include problem\n formalization, identification of vulnerabilities, novel solutions and\n prototypes for new technologies. CoreLabs regularly publishes security\n advisories, technical papers, project information and shared software\n tools for public use at:\n http://corelabs.coresecurity.com. \n\n\n12. *About Core Security Technologies*\n\n Core Security Technologies enables organizations to get ahead of threats\n with security test and measurement solutions that continuously identify\n and demonstrate real-world exposures to their most critical assets. Our\n customers can gain real visibility into their security standing, real\n validation of their security controls, and real metrics to more\n effectively secure their organizations. \n\n Core Security\u0027s software solutions build on over a decade of trusted\n research and leading-edge threat expertise from the company\u0027s Security\n Consulting Services, CoreLabs and Engineering groups. Core Security\n Technologies can be reached at +1 (617) 399-6980 or on the Web at:\n http://www.coresecurity.com. \n\n\n13. *Disclaimer*\n\n The contents of this advisory are copyright\n (c) 2014 Core Security and (c) 2014 CoreLabs,\n and are licensed under a Creative Commons\n Attribution Non-Commercial Share-Alike 3.0 (United States) License:\n http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n\n14. *PGP/GPG Keys*\n\n This advisory has been signed with the GPG key of Core Security\nadvisories\n team, which is available for download at\n \nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "BID",
"id": "69536"
},
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-68484"
},
{
"db": "PACKETSTORM",
"id": "128120"
}
],
"trust": 2.97
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-0991",
"trust": 3.9
},
{
"db": "ICS CERT",
"id": "ICSA-14-261-01",
"trust": 3.1
},
{
"db": "BID",
"id": "69536",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2014-05417",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358",
"trust": 0.8
},
{
"db": "OSVDB",
"id": "110686",
"trust": 0.6
},
{
"db": "CXSECURITY",
"id": "WLB-2014090006",
"trust": 0.6
},
{
"db": "IVD",
"id": "3A306310-1EC1-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "D278C6B4-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-68484",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128120",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "VULHUB",
"id": "VHN-68484"
},
{
"db": "BID",
"id": "69536"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "PACKETSTORM",
"id": "128120"
},
{
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"id": "VAR-201409-0445",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "VULHUB",
"id": "VHN-68484"
}
],
"trust": 1.5326718400000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-05417"
}
]
},
"last_update_date": "2023-12-18T13:09:19.452000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Advantech WebAccess",
"trust": 0.8,
"url": "http://www.advantech.co.jp/products/gf-1m94v/advantech-webaccess/mod_b975c492-56b3-4eba-8bbb-5b6d3483ee9d.aspx"
},
{
"title": "Patch for Advantech WebAccess Buffer Overflow Vulnerability (CNVD-2014-05417)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/53297"
},
{
"title": "AdvantechWebAccessUSANode_20140730_3.4.3",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=51645"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68484"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "NVD",
"id": "CVE-2014-0991"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-14-261-01"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/69536"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0991"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0991"
},
{
"trust": 0.6,
"url": "http://cxsecurity.com/issue/wlb-2014090006"
},
{
"trust": 0.6,
"url": "http://osvdb.com/show/osvdb/110686"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0987"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/"
},
{
"trust": 0.1,
"url": "http://webaccess.advantech.com/."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0988"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/published/."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0992"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/advisories/advantech-webaccess-vulnerabilities"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0989"
},
{
"trust": 0.1,
"url": "https://github.com/coresecurity/sentinel."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0991"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0990"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://webaccess.advantech.com/downloads_software.php"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0986"
},
{
"trust": 0.1,
"url": "http://support.microsoft.com/kb/2458544."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0985"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "VULHUB",
"id": "VHN-68484"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "PACKETSTORM",
"id": "128120"
},
{
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"db": "VULHUB",
"id": "VHN-68484"
},
{
"db": "BID",
"id": "69536"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"db": "PACKETSTORM",
"id": "128120"
},
{
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-09-05T00:00:00",
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"date": "2014-09-05T00:00:00",
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-09-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"date": "2014-09-20T00:00:00",
"db": "VULHUB",
"id": "VHN-68484"
},
{
"date": "2014-09-02T00:00:00",
"db": "BID",
"id": "69536"
},
{
"date": "2014-09-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"date": "2014-09-02T22:28:11",
"db": "PACKETSTORM",
"id": "128120"
},
{
"date": "2014-09-20T10:55:04.213000",
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"date": "2014-09-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-05417"
},
{
"date": "2015-08-05T00:00:00",
"db": "VULHUB",
"id": "VHN-68484"
},
{
"date": "2014-09-22T18:05:00",
"db": "BID",
"id": "69536"
},
{
"date": "2014-09-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004358"
},
{
"date": "2015-08-05T16:06:35.637000",
"db": "NVD",
"id": "CVE-2014-0991"
},
{
"date": "2014-09-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Advantech WebAccess Vulnerable to stack-based buffer overflow",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-004358"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "3a306310-1ec1-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "d278c6b4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-738"
}
],
"trust": 1.0
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.