Details of VAR-201304-0154

ID

VAR-201304-0154

CVE

CVE-2013-0682

TITLE

Cogent Real-Time Systems DataHub Text Command Buffer Overflow Vulnerability

Trust: 0.8

sources: IVD: 038f53d4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02823

DESCRIPTION

Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 do not properly handle exceptions, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed data in a formatted text command, leading to out-of-bounds access to (1) heap or (2) stack memory. Cogent Real-Time Systems is a real-time data solutions vendor. The Cogent Real-Time Systems DataHub application receives formatted text commands in TCP link mode that are parsed, verified, and executed within the application. An attacker can exploit this issue to execute arbitrary code within the context of the affected applications. Failed exploit attempts may crash the application, denying service to legitimate users. The following Cogent Real-Time Systems products are vulnerable: Cogent DataHub 7.2.2 and prior versions OPC DataHub 6.4.21 and prior versions Cascade DataHub for Windows 6.4.21 and prior versions Cogent DataHub DataSim and DataPid demonstration clients 7.2.2 OPC DataHub DataSim and DataPid demonstration clients 6.4.21 Cascade DataHub DataSim and DataPid demonstration clients 6.4.21 DataHub QuickTrend 7.2.2 and prior versions

Trust: 2.61

sources: NVD: CVE-2013-0682 // JVNDB: JVNDB-2013-002156 // CNVD: CNVD-2013-02823 // BID: 58905 // IVD: 038f53d4-2353-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 038f53d4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02823

AFFECTED PRODUCTS

vendor:	cogentdatahub	model:	cogent datahub	scope:	eq	version:	7.1.1	Trust: 1.6
vendor:	cogentdatahub	model:	cascade datahub	scope:	eq	version:	6.4.20	Trust: 1.6
vendor:	cogentdatahub	model:	cogent datahub	scope:	eq	version:	7.1.1.63	Trust: 1.6
vendor:	cogentdatahub	model:	cogent datahub	scope:	eq	version:	7.1.2	Trust: 1.6
vendor:	cogentdatahub	model:	cogent datahub	scope:	eq	version:	7.1.0	Trust: 1.6
vendor:	cogentdatahub	model:	opc datahub	scope:	eq	version:	6.4.20	Trust: 1.6
vendor:	cogentdatahub	model:	datahub quicktrend	scope:	lte	version:	7.2.2	Trust: 1.0
vendor:	cogentdatahub	model:	opc datahub	scope:	lte	version:	6.4.21	Trust: 1.0
vendor:	cogentdatahub	model:	cogent datahub	scope:	lte	version:	7.2.2	Trust: 1.0
vendor:	cogentdatahub	model:	cascade datahub	scope:	lte	version:	6.4.21	Trust: 1.0
vendor:	cogentdatahub	model:	cogent datahub	scope:	eq	version:	7.0.2	Trust: 1.0
vendor:	cogentdatahub	model:	cogent datahub	scope:	eq	version:	7.0	Trust: 1.0
vendor:	cogent real time	model:	cascade datahub	scope:	lt	version:	6.4.22	Trust: 0.8
vendor:	cogent real time	model:	datahub	scope:	lt	version:	7.3.0	Trust: 0.8
vendor:	cogent real time	model:	datahub quicktrend	scope:	lt	version:	7.3.0	Trust: 0.8
vendor:	cogent real time	model:	opc datahub	scope:	lt	version:	6.4.22	Trust: 0.8
vendor:	cogent	model:	real-time systems opc datahub	scope:	eq	version:	6.4.21	Trust: 0.6
vendor:	cogent	model:	real-time systems cascade datahub	scope:	eq	version:	6.4.21	Trust: 0.6
vendor:	cogent	model:	real-time systems cogent datahub	scope:	eq	version:	7.2.2	Trust: 0.6
vendor:	cogent	model:	real-time systems datahub quicktrend	scope:	eq	version:	7.2.2	Trust: 0.6
vendor:	cogent	model:	real-time systems datapid	scope:	eq	version:	7.2.2	Trust: 0.6
vendor:	cogent	model:	real-time systems datapid	scope:	eq	version:	6.4.21	Trust: 0.6
vendor:	cogent	model:	real-time systems datasim	scope:	eq	version:	7.2.2	Trust: 0.6
vendor:	cogent	model:	real-time systems datasim	scope:	eq	version:	6.4.21	Trust: 0.6
vendor:	cogentdatahub	model:	datahub quicktrend	scope:	eq	version:	7.2.2	Trust: 0.6
vendor:	cogentdatahub	model:	cogent datahub	scope:	eq	version:	7.2.2	Trust: 0.6
vendor:	cogentdatahub	model:	cascade datahub	scope:	eq	version:	6.4.21	Trust: 0.6
vendor:	cogentdatahub	model:	opc datahub	scope:	eq	version:	6.4.21	Trust: 0.6
vendor:	cogent	model:	real-time systems opc datahub	scope:	eq	version:	6.4.20	Trust: 0.3
vendor:	cogent	model:	real-time systems opc datahub	scope:	eq	version:	6.0.2	Trust: 0.3
vendor:	cogent	model:	real-time systems opc datahub	scope:	eq	version:	6	Trust: 0.3
vendor:	cogent	model:	real-time systems cogent datahub	scope:	eq	version:	7.1.2	Trust: 0.3
vendor:	cogent	model:	real-time systems cogent datahub	scope:	eq	version:	7.1.1.63	Trust: 0.3
vendor:	cogent	model:	real-time systems cogent datahub	scope:	eq	version:	7	Trust: 0.3
vendor:	cogent datahub	model:	-	scope:	eq	version:	7.0	Trust: 0.2
vendor:	cogent datahub	model:	-	scope:	eq	version:	7.0.2	Trust: 0.2
vendor:	cogent datahub	model:	-	scope:	eq	version:	7.1.0	Trust: 0.2
vendor:	cogent datahub	model:	-	scope:	eq	version:	7.1.1	Trust: 0.2
vendor:	cogent datahub	model:	-	scope:	eq	version:	7.1.1.63	Trust: 0.2
vendor:	cogent datahub	model:	-	scope:	eq	version:	7.1.2	Trust: 0.2
vendor:	cogent datahub	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	opc datahub	model:	-	scope:	eq	version:	6.4.20	Trust: 0.2
vendor:	opc datahub	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	cascade datahub	model:	-	scope:	eq	version:	6.4.20	Trust: 0.2
vendor:	cascade datahub	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	datahub quicktrend	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 038f53d4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02823 // BID: 58905 // JVNDB: JVNDB-2013-002156 // CNNVD: CNNVD-201304-032 // NVD: CVE-2013-0682

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-0682
value:	HIGH
Trust: 1.0
NVD:	CVE-2013-0682
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2013-02823
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201304-032
value:	HIGH
Trust: 0.6
IVD:	038f53d4-2353-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2013-0682
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2013-02823
severity:	HIGH
baseScore:	8.5
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	7.8
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	038f53d4-2353-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	8.5
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	7.8
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 038f53d4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02823 // JVNDB: JVNDB-2013-002156 // CNNVD: CNNVD-201304-032 // NVD: CVE-2013-0682

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2013-002156 // NVD: CVE-2013-0682

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201304-032

TYPE

Buffer overflow

Trust: 0.8

sources: IVD: 038f53d4-2353-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201304-032

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-002156

PATCH

title:	Cogent DataHub	url:	http://www.cogentdatahub.com/Products/Cogent_DataHub.html	Trust: 0.8
title:	OPC DataHub	url:	http://www.cogentdatahub.com/Products/OPC_DataHub.html	Trust: 0.8
title:	Cascade DataHub	url:	http://www.cogentdatahub.com/Products/Cascade_DataHub.html	Trust: 0.8
title:	DataHub QuickTrend	url:	http://www.cogentdatahub.com/Products/DataHub_QuickTrend.html	Trust: 0.8
title:	Release Notes	url:	http://www.cogentdatahub.com/ReleaseNotes.html	Trust: 0.8
title:	Download Software	url:	http://www.cogentdatahub.com/Contact_Form.html	Trust: 0.8
title:	TopPage	url:	http://www.cogentdatahub.com/jp/	Trust: 0.8
title:	Cogent Real-Time Systems DataHub Text Command Buffer Overflow Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/33174	Trust: 0.6
title:	OPCDataHub-6.4.22-130302-Windows	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=45674	Trust: 0.6
title:	CogentDataHub-7.3.0-130328-Windows	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=45673	Trust: 0.6

sources: CNVD: CNVD-2013-02823 // JVNDB: JVNDB-2013-002156 // CNNVD: CNNVD-201304-032

EXTERNAL IDS

db:	NVD	id:	CVE-2013-0682	Trust: 3.5
db:	ICS CERT	id:	ICSA-13-095-01	Trust: 3.3
db:	BID	id:	58905	Trust: 0.9
db:	CNVD	id:	CNVD-2013-02823	Trust: 0.8
db:	CNNVD	id:	CNNVD-201304-032	Trust: 0.8
db:	JVNDB	id:	JVNDB-2013-002156	Trust: 0.8
db:	IVD	id:	038F53D4-2353-11E6-ABEF-000C29C66E3D	Trust: 0.2

sources: IVD: 038f53d4-2353-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02823 // BID: 58905 // JVNDB: JVNDB-2013-002156 // CNNVD: CNNVD-201304-032 // NVD: CVE-2013-0682

REFERENCES

url:	http://ics-cert.us-cert.gov/pdf/icsa-13-095-01.pdf	Trust: 3.3
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-0682	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-0682	Trust: 0.8
url:	http://www.cogentdatahub.com/products/cogent_datahub.html	Trust: 0.3

sources: CNVD: CNVD-2013-02823 // BID: 58905 // JVNDB: JVNDB-2013-002156 // CNNVD: CNNVD-201304-032 // NVD: CVE-2013-0682

CREDITS

Dillon Beresford

Trust: 0.3

sources: BID: 58905

SOURCES

db:	IVD	id:	038f53d4-2353-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2013-02823
db:	BID	id:	58905
db:	JVNDB	id:	JVNDB-2013-002156
db:	CNNVD	id:	CNNVD-201304-032
db:	NVD	id:	CVE-2013-0682

LAST UPDATE DATE

2024-11-23T21:55:36.562000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2013-02823	date:	2013-05-17T00:00:00
db:	BID	id:	58905	date:	2015-03-19T09:23:00
db:	JVNDB	id:	JVNDB-2013-002156	date:	2013-04-09T00:00:00
db:	CNNVD	id:	CNNVD-201304-032	date:	2013-04-07T00:00:00
db:	NVD	id:	CVE-2013-0682	date:	2024-11-21T01:48:00.127

SOURCES RELEASE DATE

db:	IVD	id:	038f53d4-2353-11e6-abef-000c29c66e3d	date:	2013-04-09T00:00:00
db:	CNVD	id:	CNVD-2013-02823	date:	2013-04-09T00:00:00
db:	BID	id:	58905	date:	2013-04-05T00:00:00
db:	JVNDB	id:	JVNDB-2013-002156	date:	2013-04-09T00:00:00
db:	CNNVD	id:	CNNVD-201304-032	date:	2013-04-07T00:00:00
db:	NVD	id:	CVE-2013-0682	date:	2013-04-05T21:55:00.863