ID

VAR-201402-0033


CVE

CVE-2012-0270


TITLE

ABB WebWare Server 'RobNetScanHost.exe' Buffer Overflow Vulnerability

Trust: 1.1

sources: IVD: 0b350900-1f73-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-0831 // BID: 52123

DESCRIPTION

Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file to the getnum function in util/heti_main.c or (2) PVOC file to the getnum function in util/pv_import.c. Authentication is not required to exploit this vulnerability. The specific flaw exists within RobNetScanHost.exe and its parsing of network packets accepted on port 5512. The parsing of 'Netscan' packets with opcodes 0xE and 0xA are vulnerable to a stack-based buffer overflow with a fixed allocation of 20 bytes. This vulnerability can be exploited to execute arbitrary code in the context of the service process (LocalSystem). ABB WebWare Server is a software product used primarily for production data control. RobNetScanHost.exe provided by ABB WebWare Server has security flaws. Csound is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds check user-supplied data. Failed attacks will cause denial-of-service conditions. Csound 5.13.0 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Secunia presentations @ RSA Conference 2012, San Francisco, USA, 27 Feb-02 March Listen to our Chief Security Specialist, Research Analyst Director, and Director Product Management & Quality Assurance discuss the industry's key topics. Also, visit the Secunia stand #817. Find out more: http://www.rsaconference.com/events/2012/usa/index.htm ---------------------------------------------------------------------- TITLE: ABB Multiple Products RobNetScanHost.exe Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA48090 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48090/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48090 RELEASE DATE: 2012-02-23 DISCUSS ADVISORY: http://secunia.com/advisories/48090/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/48090/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=48090 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in multiple ABB products, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is reported in the following versions: * RobotStudio, Robot Communications Runtime, PC SDK, and IRC5 OPC Server version 5.41.01 and prior. * PickMaster 3 version 3.3 and prior. * PickMaster 5 version 5.13 and prior. * WebWare SDK and ABB Interlink Module versions 4.6 through 4.9. * WebWare Server versions 4.6 through 4.91. SOLUTION: Update to a fixed version or apply patch (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: Luigi Auriemma via ZDI. ORIGINAL ADVISORY: ABB: http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/f261be074480dc24c12579a00049ecd5/$file/si10227a1%20vulnerability%20security%20advisory.pdf ZDI: http://www.zerodayinitiative.com/advisories/ZDI-12-033/ OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-033 : ABB WebWare RobNetScanHost.exe Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-033 February 22, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: ABB - -- Affected Products: ABB WebWare - -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 11594. - -- Vendor Response: ABB has issued an update to correct this vulnerability. More details can be found at: http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/f261be074480dc24c12579a00049ecd5/$file/si10227a1%20vulnerability%20security%20advisory.pdf - -- Disclosure Timeline: 2011-10-10 - Vulnerability reported to vendor 2012-02-22 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * Luigi Auriemma - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) iQEcBAEBAgAGBQJPRUiZAAoJEFVtgMGTo1sc9REIAKdxGGjQNRsQBQh7OZ3Bbfz2 vbul36hrqRdCxEmV++F5LcoFSpXmRx7Wjc6FHcUKkGGbRQ7+I9zjAi4CzwubSjCY zk+G0v324lSwQ7be6bxp5kGl5UTjVDczlfyjG2K2QSPBitz/RpkhpaTDXJcBALLR lx8KOxgAT9TGEodE5pjG2R2eCeDgrV34q5+xu3hdMQYWgvdYqoL39OHw/7QMjIOT NO1hYzGpadTcRuXwDzkpsJi+Gx03DinnlJ1VjUaXPfdbnN7IpGoON7yaYkjXDBVf NHA2pvKBl0mRjevIy/uQqJpsG8KC4eR5pHdl/lTKV61vb45zAyewDo5EM9xl6J0= =DeOF -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Trust: 3.78

sources: NVD: CVE-2012-0270 // JVNDB: JVNDB-2012-006154 // ZDI: ZDI-12-033 // CNVD: CNVD-2012-0831 // BID: 52144 // BID: 52123 // IVD: 0b350900-1f73-11e6-abef-000c29c66e3d // PACKETSTORM: 110138 // PACKETSTORM: 110124 // PACKETSTORM: 110090

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 0b350900-1f73-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-0831

AFFECTED PRODUCTS

vendor:csoundsmodel:csoundscope:eqversion:5.14.1

Trust: 1.6

vendor:csoundsmodel:csoundscope:eqversion:5.14.2

Trust: 1.6

vendor:csoundsmodel:csoundscope:eqversion:5.14.0

Trust: 1.6

vendor:csoundsmodel:csoundscope:eqversion:5.15.0

Trust: 1.6

vendor:csoundsmodel:csoundscope:eqversion:5.13.0

Trust: 1.6

vendor:csoundsmodel:csoundscope:eqversion:5.13.1

Trust: 1.6

vendor:csoundsmodel:csoundscope:eqversion:5.12.4

Trust: 1.6

vendor:csoundsmodel:csoundscope:eqversion:5.16

Trust: 1.6

vendor:csoundsmodel:csoundscope:lteversion:5.16.1

Trust: 1.0

vendor:csoundmodel:csoundscope:ltversion:5.16.6

Trust: 0.8

vendor:abbmodel:webwarescope: - version: -

Trust: 0.7

vendor:abbmodel:webware serverscope: - version: -

Trust: 0.6

vendor:csoundsmodel:csoundscope:eqversion:5.16.1

Trust: 0.6

vendor:susemodel:opensusescope:eqversion:11.4

Trust: 0.3

vendor:csoundmodel:csoundscope:eqversion:5.13.0

Trust: 0.3

vendor:csoundmodel:csoundscope:neversion:5.16.6

Trust: 0.3

vendor:abbmodel:webware serverscope:eqversion:0

Trust: 0.3

vendor:abbmodel:webware server nullscope:eqversion:*

Trust: 0.2

sources: IVD: 0b350900-1f73-11e6-abef-000c29c66e3d // ZDI: ZDI-12-033 // CNVD: CNVD-2012-0831 // BID: 52144 // BID: 52123 // JVNDB: JVNDB-2012-006154 // CNNVD: CNNVD-201202-450 // NVD: CVE-2012-0270

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-0270
value: HIGH

Trust: 1.0

NVD: CVE-2012-0270
value: HIGH

Trust: 0.8

ZDI: ZDI-12-033
value: HIGH

Trust: 0.7

CNNVD: CNNVD-201202-450
value: HIGH

Trust: 0.6

IVD: 0b350900-1f73-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2012-0270
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: ZDI-12-033
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

IVD: 0b350900-1f73-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.0
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 6.8
impactScore: 7.8
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0 [IVD]

Trust: 0.2

sources: IVD: 0b350900-1f73-11e6-abef-000c29c66e3d // ZDI: ZDI-12-033 // JVNDB: JVNDB-2012-006154 // CNNVD: CNNVD-201202-450 // NVD: CVE-2012-0270

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2012-006154 // NVD: CVE-2012-0270

THREAT TYPE

remote

Trust: 1.3

sources: PACKETSTORM: 110090 // CNNVD: CNNVD-201202-441 // CNNVD: CNNVD-201202-450

TYPE

Buffer overflow

Trust: 1.4

sources: IVD: 0b350900-1f73-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201202-441 // CNNVD: CNNVD-201202-450

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-006154

PATCH

title:Cve 2012 0270 csound getnum bof #309url:https://github.com/rapid7/metasploit-framework/pull/309

Trust: 0.8

title:Notes for 5.16url:http://sourceforge.net/projects/csound/files/csound5/csound5.16/Version5.16_Notes/view

Trust: 0.8

title:ABB has issued an update to correct this vulnerability.url:http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/f261be074480dc24c12579a00049ecd5/$file/si10227a1%20vulnerability%20security%20advisory.pdf

Trust: 0.7

title:ABB WebWare Server 'RobNetScanHost.exe' patch overflow vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/10812

Trust: 0.6

sources: ZDI: ZDI-12-033 // CNVD: CNVD-2012-0831 // JVNDB: JVNDB-2012-006154

EXTERNAL IDS

db:NVDid:CVE-2012-0270

Trust: 2.7

db:ZDIid:ZDI-12-033

Trust: 1.8

db:SECUNIAid:47585

Trust: 1.7

db:BIDid:52123

Trust: 1.5

db:BIDid:52144

Trust: 0.9

db:CNVDid:CNVD-2012-0831

Trust: 0.8

db:JVNDBid:JVNDB-2012-006154

Trust: 0.8

db:SECUNIAid:48090

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-1260

Trust: 0.7

db:CNNVDid:CNNVD-201202-441

Trust: 0.6

db:SUSEid:OPENSUSE-SU-2012:0370

Trust: 0.6

db:SUSEid:OPENSUSE-SU-2012:0315

Trust: 0.6

db:CNNVDid:CNNVD-201202-450

Trust: 0.6

db:ICS CERTid:ICSA-12-059-01

Trust: 0.3

db:IVDid:0B350900-1F73-11E6-ABEF-000C29C66E3D

Trust: 0.2

db:PACKETSTORMid:110138

Trust: 0.1

db:PACKETSTORMid:110124

Trust: 0.1

db:PACKETSTORMid:110090

Trust: 0.1

sources: IVD: 0b350900-1f73-11e6-abef-000c29c66e3d // ZDI: ZDI-12-033 // CNVD: CNVD-2012-0831 // BID: 52144 // BID: 52123 // JVNDB: JVNDB-2012-006154 // PACKETSTORM: 110138 // PACKETSTORM: 110124 // PACKETSTORM: 110090 // CNNVD: CNNVD-201202-441 // CNNVD: CNNVD-201202-450 // NVD: CVE-2012-0270

REFERENCES

url:http://sourceforge.net/projects/csound/files/csound5/csound5.16/version5.16_notes/view

Trust: 2.0

url:http://secunia.com/secunia_research/2012-3/

Trust: 2.0

url:http://secunia.com/advisories/47585

Trust: 1.6

url:http://lists.opensuse.org/opensuse-updates/2012-03/msg00027.html

Trust: 1.6

url:http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00027.html

Trust: 1.6

url:http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/f261be074480dc24c12579a00049ecd5/$file/si10227a1%20vulnerability%20security%20advisory.pdf

Trust: 1.2

url:http://www.zerodayinitiative.com/advisories/zdi-12-033/

Trust: 1.0

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0270

Trust: 0.8

url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-0270

Trust: 0.8

url:http://www.securityfocus.com/bid/52123

Trust: 0.6

url:http://secunia.com/advisories/48090

Trust: 0.6

url:http://www.securityfocus.com/bid/52144

Trust: 0.6

url:http://csound.sourceforge.net/

Trust: 0.3

url:http://www.abb.com/

Trust: 0.3

url:http://www.us-cert.gov/control_systems/pdf/icsa-12-059-01.pdf

Trust: 0.3

url:http://www.rsaconference.com/events/2012/usa/index.htm

Trust: 0.2

url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

Trust: 0.2

url:http://secunia.com/vulnerability_intelligence/

Trust: 0.2

url:http://secunia.com/advisories/secunia_security_advisories/

Trust: 0.2

url:http://secunia.com/vulnerability_scanning/personal/

Trust: 0.2

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.2

url:http://secunia.com/advisories/about_secunia_advisories/

Trust: 0.2

url:https://ca.secunia.com/?page=viewadvisory&vuln_id=47585

Trust: 0.1

url:http://secunia.com/advisories/47585/#comments

Trust: 0.1

url:http://secunia.com/advisories/47585/

Trust: 0.1

url:https://ca.secunia.com/?page=viewadvisory&vuln_id=48090

Trust: 0.1

url:http://secunia.com/advisories/48090/#comments

Trust: 0.1

url:http://secunia.com/advisories/48090/

Trust: 0.1

url:http://www.zerodayinitiative.com/advisories/disclosure_policy/

Trust: 0.1

url:http://www.zerodayinitiative.com/advisories/zdi-12-033

Trust: 0.1

url:http://secunia.com/

Trust: 0.1

url:http://twitter.com/thezdi

Trust: 0.1

url:http://www.tippingpoint.com

Trust: 0.1

url:http://www.zerodayinitiative.com

Trust: 0.1

url:http://lists.grok.org.uk/full-disclosure-charter.html

Trust: 0.1

sources: ZDI: ZDI-12-033 // CNVD: CNVD-2012-0831 // BID: 52144 // BID: 52123 // JVNDB: JVNDB-2012-006154 // PACKETSTORM: 110138 // PACKETSTORM: 110124 // PACKETSTORM: 110090 // CNNVD: CNNVD-201202-441 // CNNVD: CNNVD-201202-450 // NVD: CVE-2012-0270

CREDITS

Secunia

Trust: 1.1

sources: BID: 52144 // PACKETSTORM: 110138 // PACKETSTORM: 110124 // CNNVD: CNNVD-201202-450

SOURCES

db:IVDid:0b350900-1f73-11e6-abef-000c29c66e3d
db:ZDIid:ZDI-12-033
db:CNVDid:CNVD-2012-0831
db:BIDid:52144
db:BIDid:52123
db:JVNDBid:JVNDB-2012-006154
db:PACKETSTORMid:110138
db:PACKETSTORMid:110124
db:PACKETSTORMid:110090
db:CNNVDid:CNNVD-201202-441
db:CNNVDid:CNNVD-201202-450
db:NVDid:CVE-2012-0270

LAST UPDATE DATE

2024-08-14T13:36:40.036000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-12-033date:2012-02-22T00:00:00
db:CNVDid:CNVD-2012-0831date:2012-02-24T00:00:00
db:BIDid:52144date:2012-04-09T12:00:00
db:BIDid:52123date:2012-02-22T00:00:00
db:JVNDBid:JVNDB-2012-006154date:2014-02-19T00:00:00
db:CNNVDid:CNNVD-201202-441date:2012-02-24T00:00:00
db:CNNVDid:CNNVD-201202-450date:2014-02-19T00:00:00
db:NVDid:CVE-2012-0270date:2014-02-18T19:49:13.147

SOURCES RELEASE DATE

db:IVDid:0b350900-1f73-11e6-abef-000c29c66e3ddate:2012-02-24T00:00:00
db:ZDIid:ZDI-12-033date:2012-02-22T00:00:00
db:CNVDid:CNVD-2012-0831date:2012-02-24T00:00:00
db:BIDid:52144date:2012-02-23T00:00:00
db:BIDid:52123date:2012-02-22T00:00:00
db:JVNDBid:JVNDB-2012-006154date:2014-02-19T00:00:00
db:PACKETSTORMid:110138date:2012-02-23T07:48:37
db:PACKETSTORMid:110124date:2012-02-23T07:47:55
db:PACKETSTORMid:110090date:2012-02-23T04:56:49
db:CNNVDid:CNNVD-201202-441date:1900-01-01T00:00:00
db:CNNVDid:CNNVD-201202-450date:2012-02-27T00:00:00
db:NVDid:CVE-2012-0270date:2014-02-17T16:55:07.883