Sign-up

ID

VAR-201303-0260


CVE

CVE-2013-0678


TITLE

Siemens SIMATIC WinCC And PCS 7 Multiple Security Vulnerabilities

Trust: 0.9

sources: BID: 58545 // CNNVD: CNNVD-201303-363

DESCRIPTION

Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly represent WebNavigator credentials in a database, which makes it easier for remote authenticated users to obtain sensitive information via a SQL query. Siemens SIMATIC WinCC is a monitoring control and data acquisition SCADA and human machine interface HMI system. Siemens SIMATIC PCS is a process control system. Siemens SIMATIC WinCC 7.2, Siemens SIMATIC PCS 7 8.0 SP1 versions have information disclosure, directory traversal, buffer overflow security vulnerabilities, which can be exploited by attackers to obtain sensitive information, any system files, and execute arbitrary applications in the context of applications using ActiveX controls. Code. Multiple information-disclosure vulnerabilities 2. A directory-traversal vulnerability 3. Failed exploit attempts will result in a denial-of-service conditions

Trust: 2.7

sources: NVD: CVE-2013-0678 // JVNDB: JVNDB-2013-001990 // CNVD: CNVD-2013-02175 // BID: 58545 // IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d // VULHUB: VHN-60680

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02175

AFFECTED PRODUCTS

vendor:siemensmodel:winccscope:eqversion:7.0

Trust: 1.6

vendor:siemensmodel:simatic winccscope:ltversion:7.2

Trust: 1.4

vendor:siemensmodel:winccscope:lteversion:7.0

Trust: 1.0

vendor:siemensmodel:simatic pcs7scope:lteversion:8.0

Trust: 1.0

vendor:siemensmodel:simatic pcs 7scope:ltversion:8.0 sp1

Trust: 0.8

vendor:winccmodel: - scope:eqversion:7.0

Trust: 0.6

vendor:siemensmodel:simatic pcs sp1scope:eqversion:7<8.0

Trust: 0.6

vendor:siemensmodel:simatic pcs7scope:eqversion:8.0

Trust: 0.6

vendor:simatic pcs7model: - scope:eqversion:*

Trust: 0.2

vendor:winccmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02175 // JVNDB: JVNDB-2013-001990 // CNNVD: CNNVD-201303-446 // NVD: CVE-2013-0678

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-0678
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-0678
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2013-02175
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201303-446
value: MEDIUM

Trust: 0.6

IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-60680
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-0678
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-02175
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-60680
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02175 // VULHUB: VHN-60680 // JVNDB: JVNDB-2013-001990 // CNNVD: CNNVD-201303-446 // NVD: CVE-2013-0678

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.9

sources: VULHUB: VHN-60680 // JVNDB: JVNDB-2013-001990 // NVD: CVE-2013-0678

THREAT TYPE

remote

Trust: 1.3

sources: PACKETSTORM: 120899 // CNNVD: CNNVD-201303-363 // CNNVD: CNNVD-201303-446

TYPE

Trust management

Trust: 0.8

sources: IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201303-446

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-001990

PATCH
title:Top Pageurl:http://www.siemens.com/entry/cc/en/
Trust: 0.8
title:SSA-714398: Vulnerabilities in WinCC 7.0 SP3 Update 1url:http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf
Trust: 0.8
title:シーメンスソリューションパートナーurl:http://www.automation.siemens.com/automation/jp/ja/solutionpartner/pages/default.aspx
Trust: 0.8
title:シーメンス・ジャパン株式会社url:http://www.siemens.com/answers/jp/ja/
Trust: 0.8
title:Siemens SIMATIC WinCC and PCS 7 have patches for multiple vulnerabilities such as information leakage, directory traversal, buffer overflows, etc.url:https://www.cnvd.org.cn/patchInfo/show/33002
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-02175 // 
            
            
            
            JVNDB: JVNDB-2013-001990

EXTERNAL IDS
db:NVDid:CVE-2013-0678
Trust: 3.1
db:ICS CERTid:ICSA-13-079-02
Trust: 2.8
db:SIEMENSid:SSA-714398
Trust: 2.0
db:BIDid:58545
Trust: 1.5
db:CNNVDid:CNNVD-201303-446
Trust: 0.9
db:JVNDBid:JVNDB-2013-001990
Trust: 0.8
db:CNVDid:CNVD-2013-02175
Trust: 0.6
db:CNNVDid:CNNVD-201303-363
Trust: 0.6
db:IVDid:0911AD8E-2353-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:120899
Trust: 0.2
db:VULHUBid:VHN-60680
Trust: 0.1
sources:
            
            
            IVD: 0911ad8e-2353-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2013-02175 // 
            
            
            
            VULHUB: VHN-60680 // 
            
            
            
            BID: 58545 // 
            
            
            
            JVNDB: JVNDB-2013-001990 // 
            
            
            
            PACKETSTORM: 120899 // 
            
            
            
            CNNVD: CNNVD-201303-363 // 
            
            
            
            CNNVD: CNNVD-201303-446 // 
            
            
            
            NVD: CVE-2013-0678

REFERENCES
url:http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf
Trust: 2.0
url:http://ics-cert.us-cert.gov/pdf/icsa-13-079-02.pdf
Trust: 2.0
url:http://www.securityfocus.com/bid/58545
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0678
Trust: 0.8
url:http://ics-cert.us-cert.gov/pdf/icsa-13-079-02-a.pdf
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0678
Trust: 0.8
url:http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/scada/simatic-wincc/pages/default.aspx
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2013-0677
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-0674
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-0678
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-0676
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-0679
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-0675
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-02175 // 
            
            
            
            VULHUB: VHN-60680 // 
            
            
            
            BID: 58545 // 
            
            
            
            JVNDB: JVNDB-2013-001990 // 
            
            
            
            PACKETSTORM: 120899 // 
            
            
            
            CNNVD: CNNVD-201303-363 // 
            
            
            
            CNNVD: CNNVD-201303-446 // 
            
            
            
            NVD: CVE-2013-0678

CREDITS
Vendor, Gleb Gritsai and Sergey Gordeychik from Positive Technologies
Trust: 0.9
sources:
            
            
            BID: 58545 // 
            
            
            
            CNNVD: CNNVD-201303-363

SOURCES
db:IVDid:0911ad8e-2353-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-02175
db:VULHUBid:VHN-60680
db:BIDid:58545
db:JVNDBid:JVNDB-2013-001990
db:PACKETSTORMid:120899
db:CNNVDid:CNNVD-201303-363
db:CNNVDid:CNNVD-201303-446
db:NVDid:CVE-2013-0678

LAST UPDATE DATE
2024-08-14T14:06:52.386000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-02175date:2013-03-26T00:00:00
db:VULHUBid:VHN-60680date:2013-03-22T00:00:00
db:BIDid:58545date:2013-04-02T15:37:00
db:JVNDBid:JVNDB-2013-001990date:2013-03-25T00:00:00
db:CNNVDid:CNNVD-201303-363date:2013-03-19T00:00:00
db:CNNVDid:CNNVD-201303-446date:2013-03-29T00:00:00
db:NVDid:CVE-2013-0678date:2013-03-22T04:00:00

SOURCES RELEASE DATE
db:IVDid:0911ad8e-2353-11e6-abef-000c29c66e3ddate:2013-03-22T00:00:00
db:CNVDid:CNVD-2013-02175date:2013-03-26T00:00:00
db:VULHUBid:VHN-60680date:2013-03-21T00:00:00
db:BIDid:58545date:2013-03-15T00:00:00
db:JVNDBid:JVNDB-2013-001990date:2013-03-25T00:00:00
db:PACKETSTORMid:120899date:2013-03-21T15:07:17
db:CNNVDid:CNNVD-201303-363date:2013-03-19T00:00:00
db:CNNVDid:CNNVD-201303-446date:2013-03-22T00:00:00
db:NVDid:CVE-2013-0678date:2013-03-21T15:55:01.600