Sign-up

ID

VAR-201304-0435


CVE

CVE-2013-3075


TITLE

Mitsubishi MX Component ActiveX Control 'ActUWzd.dll' Remote Buffer Overflow Vulnerability

Trust: 1.1

sources: IVD: fab9ddba-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02230 // BID: 58692

DESCRIPTION

Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities 7.10 and CitectScada 7.10r1, allow remote attackers to execute arbitrary code via a long string, as demonstrated by a long WzTitle property value to a certain ActiveX control. Mitsubishi MX Component ActiveX dynamic link library for PC software and Mitsubishi FX/A/Q series links. Mitsubishi MX is prone to remote buffer-overflow vulnerability. Failed exploit attempts will result in a denial-of-service condition. CitectFacilities is an open and comprehensive facilities management solution designed specifically for managing large built environments. CitectSCADA is software used to provide monitoring and control functions in a supervisory control and data acquisition system (SCADA). There are multiple buffer overflow vulnerabilities in the ActUWzd.dll file version 1.0.0.1 in this component

Trust: 2.7

sources: NVD: CVE-2013-3075 // JVNDB: JVNDB-2013-002424 // CNVD: CNVD-2013-02230 // BID: 58692 // IVD: fab9ddba-2352-11e6-abef-000c29c66e3d // VULHUB: VHN-63077

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: fab9ddba-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02230

AFFECTED PRODUCTS

vendor:schneider electricmodel:citectfacilitiesscope:eqversion:7.10

Trust: 2.7

vendor:schneider electricmodel:citectscadascope:eqversion:7.10

Trust: 1.6

vendor:mitsubishi automationmodel:mx componentscope:eqversion:3

Trust: 1.0

vendor:schneider electricmodel:citectscadascope:eqversion:7.10r1

Trust: 0.8

vendor:mitsubishi electricmodel:mx componentscope:eqversion:3 of actuwzd.dll 1.0.0.1

Trust: 0.8

vendor:schneidermodel:electric mitsubishi mx activex componentscope:eqversion:3

Trust: 0.6

vendor:schneider electricmodel:citectscada 7.10r1scope: - version: -

Trust: 0.3

vendor:mitsubishimodel:electric mx component versionscope:eqversion:30

Trust: 0.3

vendor:mitsubishimodel:electric mx componentscope:neversion:4.03

Trust: 0.3

vendor:mitsubishi mx componentmodel: - scope:eqversion:3

Trust: 0.2

vendor:citectfacilitiesmodel: - scope:eqversion:7.10

Trust: 0.2

vendor:citectscadamodel: - scope:eqversion:7.10

Trust: 0.2

sources: IVD: fab9ddba-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02230 // BID: 58692 // JVNDB: JVNDB-2013-002424 // CNNVD: CNNVD-201304-439 // NVD: CVE-2013-3075

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-3075
value: HIGH

Trust: 1.0

NVD: CVE-2013-3075
value: HIGH

Trust: 0.8

CNVD: CNVD-2013-02230
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201304-439
value: CRITICAL

Trust: 0.6

IVD: fab9ddba-2352-11e6-abef-000c29c66e3d
value: CRITICAL

Trust: 0.2

VULHUB: VHN-63077
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-3075
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-02230
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: fab9ddba-2352-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-63077
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: fab9ddba-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-02230 // VULHUB: VHN-63077 // JVNDB: JVNDB-2013-002424 // CNNVD: CNNVD-201304-439 // NVD: CVE-2013-3075

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-63077 // JVNDB: JVNDB-2013-002424 // NVD: CVE-2013-3075

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201304-439 // CNNVD: CNNVD-201303-494

TYPE

Buffer overflow

Trust: 1.4

sources: IVD: fab9ddba-2352-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201304-439 // CNNVD: CNNVD-201303-494

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-002424

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-63077

PATCH
title:Top Pageurl:http://www.schneider-electric.com/
Trust: 0.8
title:γ‚΅γƒγƒΌγƒˆurl:http://www.schneider-electric.co.jp/sites/japan/jp/support/contact/we-care.page
Trust: 0.8
title:MX Componenturl:http://www.mitsubishielectric.co.jp/fa/products/cnt/plceng/lineup/mx_component/
Trust: 0.8
title:Top Pageurl:http://www.schneider-electric.com/site/home/index.cfm/jp/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-002424

EXTERNAL IDS
db:NVDid:CVE-2013-3075
Trust: 3.6
db:EXPLOIT-DBid:24886
Trust: 2.3
db:BIDid:58692
Trust: 1.6
db:ICS CERTid:ICSA-13-140-01
Trust: 1.1
db:ICS CERT ALERTid:ICS-ALERT-13-091-01
Trust: 1.1
db:CNNVDid:CNNVD-201304-439
Trust: 0.9
db:CNVDid:CNVD-2013-02230
Trust: 0.8
db:JVNDBid:JVNDB-2013-002424
Trust: 0.8
db:CNNVDid:CNNVD-201303-494
Trust: 0.6
db:IVDid:FAB9DDBA-2352-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:SEEBUGid:SSVID-78572
Trust: 0.1
db:VULHUBid:VHN-63077
Trust: 0.1
sources:
            
            
            IVD: fab9ddba-2352-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2013-02230 // 
            
            
            
            VULHUB: VHN-63077 // 
            
            
            
            BID: 58692 // 
            
            
            
            JVNDB: JVNDB-2013-002424 // 
            
            
            
            CNNVD: CNNVD-201304-439 // 
            
            
            
            CNNVD: CNNVD-201303-494 // 
            
            
            
            NVD: CVE-2013-3075

REFERENCES
url:http://www.exploit-db.com/exploits/24886/
Trust: 2.3
url:http://ics-cert.us-cert.gov/pdf/ics-alert-13-091-01.pdf
Trust: 1.1
url:http://ics-cert.us-cert.gov/advisories/icsa-13-140-01
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3075
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3075
Trust: 0.8
url:http://www.securityfocus.com/bid/58692
Trust: 0.6
url:http://www.intelliscada.com/services_facilities.html
Trust: 0.3
url:http://www.citect.com/
Trust: 0.3
url:http://www.mitsubishi-automation.com/products/software_mx_components_content.htm
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2013-02230 // 
            
            
            
            VULHUB: VHN-63077 // 
            
            
            
            BID: 58692 // 
            
            
            
            JVNDB: JVNDB-2013-002424 // 
            
            
            
            CNNVD: CNNVD-201304-439 // 
            
            
            
            CNNVD: CNNVD-201303-494 // 
            
            
            
            NVD: CVE-2013-3075

CREDITS
Dr_IDE
Trust: 0.9
sources:
            
            
            BID: 58692 // 
            
            
            
            CNNVD: CNNVD-201303-494

SOURCES
db:IVDid:fab9ddba-2352-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-02230
db:VULHUBid:VHN-63077
db:BIDid:58692
db:JVNDBid:JVNDB-2013-002424
db:CNNVDid:CNNVD-201304-439
db:CNNVDid:CNNVD-201303-494
db:NVDid:CVE-2013-3075

LAST UPDATE DATE
2024-11-23T23:09:59.922000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-02230date:2013-03-27T00:00:00
db:VULHUBid:VHN-63077date:2013-05-15T00:00:00
db:BIDid:58692date:2015-03-19T08:08:00
db:JVNDBid:JVNDB-2013-002424date:2013-05-22T00:00:00
db:CNNVDid:CNNVD-201304-439date:2013-04-22T00:00:00
db:CNNVDid:CNNVD-201303-494date:2013-03-26T00:00:00
db:NVDid:CVE-2013-3075date:2024-11-21T01:52:57.207

SOURCES RELEASE DATE
db:IVDid:fab9ddba-2352-11e6-abef-000c29c66e3ddate:2013-03-27T00:00:00
db:CNVDid:CNVD-2013-02230date:2013-03-27T00:00:00
db:VULHUBid:VHN-63077date:2013-04-19T00:00:00
db:BIDid:58692date:2013-03-25T00:00:00
db:JVNDBid:JVNDB-2013-002424date:2013-04-23T00:00:00
db:CNNVDid:CNNVD-201304-439date:2013-04-22T00:00:00
db:CNNVDid:CNNVD-201303-494date:2013-03-26T00:00:00
db:NVDid:CVE-2013-3075date:2013-04-19T11:44:29.280