Details of VAR-201209-0222

ID

VAR-201209-0222

CVE

CVE-2012-3028

TITLE

Siemens SIMATIC WinCC Cross-Site Request Forgery Vulnerability

Trust: 1.7

sources: IVD: 5ddc3ec4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-5088 // BID: 55493 // CNNVD: CNNVD-201209-303

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data or cause a denial of service. (DoS) There is a possibility of being put into a state. Siemens SIMATIC is an automation software in a single engineering environment. Siemens SIMATIC WinCC is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. Siemens SIMATIC WinCC 7.0 SP3 and prior versions are vulnerable. The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to perform certain unspecified actions when a logged-in administrative user visits a specially crafted web page. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Siemens SIMATIC WinCC Multiple Vulnerabilities SECUNIA ADVISORY ID: SA50568 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50568/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50568 RELEASE DATE: 2012-09-11 DISCUSS ADVISORY: http://secunia.com/advisories/50568/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/50568/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=50568 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Siemens SIMATIC WinCC, which can be exploited by malicious people to conduct cross-site scripting attacks, conduct SQL injection attacks, and disclose certain sensitive information. 1) Certain unspecified input passed to the WebNavigator component is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) Certain input passed to the WebNavigator component is not properly verified before being used to read files. This can be exploited to read arbitrary files via directory traversal sequences. 3) Certain input passed via SOAP messages to the WebNavigator component is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 4) An error within the ActiveX control can be exploited to disclose the username and password of an authenticated user. SOLUTION: Apply Update 3. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: The vendor credits Denis Baranov, Sergey Bobrov, Artem Chaykin, Vladimir Kochetkov, Pavel Toporkov, and Timur Yunusov, Positive Technologies. ORIGINAL ADVISORY: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.88

sources: NVD: CVE-2012-3028 // JVNDB: JVNDB-2012-004446 // CNVD: CNVD-2012-5088 // BID: 55493 // IVD: 5ddc3ec4-2353-11e6-abef-000c29c66e3d // VULHUB: VHN-56309 // PACKETSTORM: 116445 // PACKETSTORM: 116447

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 5ddc3ec4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-5088

AFFECTED PRODUCTS

vendor:	siemens	model:	simatic pcs7	scope:	eq	version:	8.0	Trust: 1.6
vendor:	siemens	model:	wincc	scope:	eq	version:	6.0	Trust: 1.6
vendor:	siemens	model:	wincc	scope:	eq	version:	5.0	Trust: 1.6
vendor:	siemens	model:	wincc	scope:	eq	version:	7.0	Trust: 1.6
vendor:	siemens	model:	wincc	scope:	lte	version:	7.0	Trust: 1.0
vendor:	siemens	model:	simatic wincc	scope:	eq	version:	6.2	Trust: 0.9
vendor:	wincc	model:	-	scope:	eq	version:	6.0	Trust: 0.8
vendor:	siemens	model:	simatic pcs 7	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	simatic wincc	scope:	lte	version:	7.0 sp3	Trust: 0.8
vendor:	wincc	model:	-	scope:	eq	version:	7.0	Trust: 0.6
vendor:	wincc	model:	-	scope:	eq	version:	5.0	Trust: 0.4
vendor:	simatic pcs7	model:	-	scope:	eq	version:	8.0	Trust: 0.2
vendor:	wincc	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 5ddc3ec4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-5088 // BID: 55493 // JVNDB: JVNDB-2012-004446 // CNNVD: CNNVD-201209-303 // NVD: CVE-2012-3028

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-3028
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-3028
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2012-5088
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201209-303
value:	MEDIUM
Trust: 0.6
IVD:	5ddc3ec4-2353-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2
VULHUB:	VHN-56309
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-3028
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2012-5088
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	7.8
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	5ddc3ec4-2353-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	7.8
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-56309
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: IVD: 5ddc3ec4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-5088 // VULHUB: VHN-56309 // JVNDB: JVNDB-2012-004446 // CNNVD: CNNVD-201209-303 // NVD: CVE-2012-3028

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-56309 // JVNDB: JVNDB-2012-004446 // NVD: CVE-2012-3028

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201209-303

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201209-303

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-004446

PATCH

title:	Top Page	url:	http://www.siemens.com/	Trust: 0.8
title:	SSA-864051: Multiple Vulnerabilities in WinCC 7.0 SP3	url:	http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf	Trust: 0.8
title:	シーメンスソリューションパートナー	url:	http://www.automation.siemens.com/automation/jp/ja/solutionpartner/pages/default.aspx	Trust: 0.8
title:	シーメンス・ジャパン株式会社	url:	http://www.siemens.com/entry/jp/ja/	Trust: 0.8
title:	Patch for Siemens SIMATIC WinCC Cross-Site Request Forgery Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/80787	Trust: 0.6

sources: CNVD: CNVD-2012-5088 // JVNDB: JVNDB-2012-004446

EXTERNAL IDS

db:	NVD	id:	CVE-2012-3028	Trust: 3.6
db:	SIEMENS	id:	SSA-864051	Trust: 2.8
db:	ICS CERT	id:	ICSA-12-256-01	Trust: 2.5
db:	BID	id:	55493	Trust: 1.0
db:	CNNVD	id:	CNNVD-201209-303	Trust: 0.9
db:	CNVD	id:	CNVD-2012-5088	Trust: 0.8
db:	JVNDB	id:	JVNDB-2012-004446	Trust: 0.8
db:	SECUNIA	id:	50581	Trust: 0.8
db:	NSFOCUS	id:	20652	Trust: 0.6
db:	NSFOCUS	id:	20933	Trust: 0.6
db:	IVD	id:	5DDC3EC4-2353-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	SECUNIA	id:	50568	Trust: 0.2
db:	VULHUB	id:	VHN-56309	Trust: 0.1
db:	PACKETSTORM	id:	116445	Trust: 0.1
db:	PACKETSTORM	id:	116447	Trust: 0.1

sources: IVD: 5ddc3ec4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-5088 // VULHUB: VHN-56309 // BID: 55493 // JVNDB: JVNDB-2012-004446 // PACKETSTORM: 116445 // PACKETSTORM: 116447 // CNNVD: CNNVD-201209-303 // NVD: CVE-2012-3028

REFERENCES

url:	http://www.us-cert.gov/control_systems/pdf/icsa-12-256-01.pdf	Trust: 2.5
url:	http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf	Trust: 2.2
url:	http://en.securitylab.ru/lab/pt-2012-42	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3028	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-3028	Trust: 0.8
url:	http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-864051.pdf	Trust: 0.6
url:	http://secunia.com/advisories/50581	Trust: 0.6
url:	http://www.securityfocus.com/bid/55493	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/20933	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/20652	Trust: 0.6
url:	http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/scada/simatic-wincc/pages/default.aspx	Trust: 0.3
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.2
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.2
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.2
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.2
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.2
url:	http://secunia.com/blog/325/	Trust: 0.2
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.2
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=50581	Trust: 0.1
url:	http://secunia.com/advisories/50581/#comments	Trust: 0.1
url:	http://secunia.com/advisories/50581/	Trust: 0.1
url:	http://secunia.com/advisories/50568/	Trust: 0.1
url:	http://secunia.com/advisories/50568/#comments	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=50568	Trust: 0.1

sources: CNVD: CNVD-2012-5088 // VULHUB: VHN-56309 // BID: 55493 // JVNDB: JVNDB-2012-004446 // PACKETSTORM: 116445 // PACKETSTORM: 116447 // CNNVD: CNNVD-201209-303 // NVD: CVE-2012-3028

CREDITS

Denis Baranov, Sergey Bobrov, Artem Chaykin, Vladimir Kochetkov, Pavel Toporkov, and Timur Yunusov from Positive Technologies

Trust: 0.9

sources: BID: 55493 // CNNVD: CNNVD-201209-303

SOURCES

db:	IVD	id:	5ddc3ec4-2353-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2012-5088
db:	VULHUB	id:	VHN-56309
db:	BID	id:	55493
db:	JVNDB	id:	JVNDB-2012-004446
db:	PACKETSTORM	id:	116445
db:	PACKETSTORM	id:	116447
db:	CNNVD	id:	CNNVD-201209-303
db:	NVD	id:	CVE-2012-3028

LAST UPDATE DATE

2024-08-14T13:48:43.964000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2012-5088	date:	2016-08-26T00:00:00
db:	VULHUB	id:	VHN-56309	date:	2012-09-19T00:00:00
db:	BID	id:	55493	date:	2015-03-19T09:33:00
db:	JVNDB	id:	JVNDB-2012-004446	date:	2012-09-20T00:00:00
db:	CNNVD	id:	CNNVD-201209-303	date:	2012-09-18T00:00:00
db:	NVD	id:	CVE-2012-3028	date:	2012-09-19T04:00:00

SOURCES RELEASE DATE

db:	IVD	id:	5ddc3ec4-2353-11e6-abef-000c29c66e3d	date:	2012-09-13T00:00:00
db:	CNVD	id:	CNVD-2012-5088	date:	2012-09-13T00:00:00
db:	VULHUB	id:	VHN-56309	date:	2012-09-18T00:00:00
db:	BID	id:	55493	date:	2012-09-11T00:00:00
db:	JVNDB	id:	JVNDB-2012-004446	date:	2012-09-20T00:00:00
db:	PACKETSTORM	id:	116445	date:	2012-09-11T07:30:00
db:	PACKETSTORM	id:	116447	date:	2012-09-11T07:30:06
db:	CNNVD	id:	CNNVD-201209-303	date:	2012-09-18T00:00:00
db:	NVD	id:	CVE-2012-3028	date:	2012-09-18T14:55:01.397