ID

VAR-201409-0444


CVE

CVE-2014-0990


TITLE

Advantech WebAccess Vulnerable to stack-based buffer overflow

Trust: 0.8

sources: JVNDB: JVNDB-2014-004357

DESCRIPTION

Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter. Advantech WebAccess is an IE-based HMI/SCADA monitoring software that features all engineering projects, database setup, drawing and software management using a standard browser over the internet or intranet. A buffer overflow vulnerability exists in Advantech WebAccess. An attacker exploits a vulnerability to execute arbitrary code in the context of an affected application or to crash the entire application. Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will likely cause a denial-of-service condition. Advantech WebAccess 7.2 is vulnerable; other versions may also be affected. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech WebAccess Vulnerabilities 1. *Advisory Information* Title: Advantech WebAccess Vulnerabilities Advisory ID: CORE-2014-0005 Advisory URL: http://www.coresecurity.com/advisories/advantech-webaccess-vulnerabilities Date published: 2014-09-02 Date of last update: 2014-09-01 Vendors contacted: Advantech Release mode: User release 2. *Vulnerability Description* Advantech WebAccess [1] is a browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. 4. WebAccess 7.2 . 5. *Non-vulnerable packages* . AdvantechWebAccessUSANode_20140730_3.4.3 6. *Vendor Information, Solutions and Workarounds* Advantech has addressed the vulnerability in WebAccess by issuing an update located at http://webaccess.advantech.com/downloads_software.php Given that this is a client-side vulnerability, affected users should avoid opening untrusted '.html' files. Core Security also recommends those affected use third party software such as Sentinel [4] or EMET [3] that could help to prevent the exploitation of affected systems to some extent. 7. *Credits* This vulnerability was discovered and researched by Ricardo Narvaja from Core Security Exploit Writers Team. Core Security Advisories Team would also like to thank ICS-CERT Coordination Center for their assistance during the vulnerability reporting process. 8. Below is shown the result of opening a malicious html file with a long NodeName parameter, an attacker can overflow the stack buffer mentioned above and overwrite the SEH (Structured Exception Handler), enabling arbitrary code execution on the machine. /----- EAX 03A39942 ASCII "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB..." ECX 0162B720 EDX 01630000 xpsp2res.01630000 EBX 0162B720 ESP 0162B454 EBP 0162B460 ESI 0162B4D8 EDI 03A31E98 EIP 064EA6D4 webvact.064EA6D4 -----/ /----- SEH chain of thread 000016CC Address SE handler 0162DB40 42424242 -----/ 9. *Report Timeline* . 2014-05-06: Core Security notifies Advantech of the vulnerability. Publication date is set for May 26th, 2014. 2014-05-09: CORE asks for a reply. 2014-05-26: First release date missed. 2014-05-26: Core Security notifies that the issues were reported 2 weeks ago and there was no reply since May 6th, 2014. 2014-05-29: Core Security contacts the ICS-CERT for assistance in order to coordinate the disclosure of the advisory. 2014-05-29: ICS-CERT acknowledges Core Security e-mail, and asks for a technical description of the vulnerability. 2014-05-29: Core Security sends technical details to the ICS-CERT. 2014-06-05: ICS-CERT team notifies that they have contacted the vendor and that they will notify us once the vendor has validated the vulnerabilities. 2014-06-18: ICS-CERT team notifies that the vendor is working in a new release, expected to be released in September, and ask if Core Security is interested in validating Advantech's vulnerability fix in their beta version. 2014-06-18: Core Security accepts the testing of the vendor beta version, but shares their concerns about waiting several months for fixes that are related to vulnerabilities already public. 2014-06-18: ICS-CERT notifies that they will let us know when they plan to make the beta version available for testing. 2014-07-03: ICS-CERT team notifies that the vendor is working to provide a download link for the beta version. 2014-07-08: ICS-CERT team sends download link provided by the vendor. 2014-07-10: Core Security confirms to ICS-CERT that the new version it's still vulnerable, and comments that after some analysis the vulnerable function doesn't has changes. 2014-07-10: ICS-CERT notifies that they will let the vendor know that that the vulnerabilities still exist. And asks to setup a teleconference between Core Security, the CERT and the vendor. 2014-07-10: Core Security notifies the ICS-CERT that all interactions are made via email only. 2014-07-10: ICS-CERT notifies they provided the information to the vendor. 2014-07-21: Core Security notifies the ICS-CERT that Tipping Point Zero Day Initiative has released several advisories[2] affecting the vendor including some that appears to be related to the one we are coordinating. 2014-07-21: ICS-CERT notifies that some of those advisories where in coordination with them, and that after a review of the link shared by Core Security are related to ICSA-14-198-02 and don't appear to be related to the reported vulnerability. 2014-07-21: Core Security notifies that ZDI-14-243 and ZDI-14-244 appears to be directly related. 2014-07-21: ICS-CERT is trying to contact Advantech to get a status update and their current plan for vulnerability remediation. 2014-08-07: ICS-CERT notifies that they contacted the vendor and they are waiting for an status update. 2014-08-21: Core Security contacts ICS-CERT since no reply was received in the past two weeks. 2014-08-21: ICS-CERT notifies that vendor representative stated that they are currently training a new product manager and they have not yet responded to the vulnerabilities we are discussing. 2014-08-28: Core Security notifies the ICS-CERT that the advisory publication is going to be scheduled for Monday 1st of September. 2014-08-28: ICS-CERT acknowledges Core Security e-mail. 2014-08-28: Core Security re-schedules the advisory publication for Sep 2nd, 2014. 2014-09-02: Core Security found out that the vendor released a silent fix on 30th of July. 2014-09-02: Core Security releases the advisory CORE-2014-0005 tagged as user-release. 10. *References* [1] http://webaccess.advantech.com/. [2] http://www.zerodayinitiative.com/advisories/published/. [3] http://support.microsoft.com/kb/2458544. [4] https://github.com/CoreSecurity/sentinel. 11. *About CoreLabs* CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2014 Core Security and (c) 2014 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc

Trust: 2.79

sources: NVD: CVE-2014-0990 // JVNDB: JVNDB-2014-004357 // CNVD: CNVD-2014-05418 // BID: 69535 // IVD: d27b8b38-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-68483 // PACKETSTORM: 128120

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: d27b8b38-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-05418

AFFECTED PRODUCTS

vendor:advantechmodel:webaccessscope:eqversion:7.2

Trust: 3.0

vendor:advantech webaccessmodel: - scope:eqversion:7.2

Trust: 0.2

sources: IVD: d27b8b38-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-05418 // JVNDB: JVNDB-2014-004357 // CNNVD: CNNVD-201409-737 // NVD: CVE-2014-0990

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-0990
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-0990
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-05418
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201409-737
value: MEDIUM

Trust: 0.6

IVD: d27b8b38-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-68483
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-0990
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-05418
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: d27b8b38-2351-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-68483
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: d27b8b38-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-05418 // VULHUB: VHN-68483 // JVNDB: JVNDB-2014-004357 // CNNVD: CNNVD-201409-737 // NVD: CVE-2014-0990

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-68483 // JVNDB: JVNDB-2014-004357 // NVD: CVE-2014-0990

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201409-737

TYPE

Buffer overflow

Trust: 0.8

sources: IVD: d27b8b38-2351-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201409-737

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-004357

PATCH

title:Advantech WebAccessurl:http://www.advantech.co.jp/products/GF-1M94V/Advantech-WebAccess/mod_B975C492-56B3-4EBA-8BBB-5B6D3483EE9D.aspx

Trust: 0.8

title:Patch for Advantech WebAccess Buffer Overflow Vulnerability (CNVD-2014-05418)url:https://www.cnvd.org.cn/patchInfo/show/53296

Trust: 0.6

title:AdvantechWebAccessUSANode_20140730_3.4.3url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51645

Trust: 0.6

sources: CNVD: CNVD-2014-05418 // JVNDB: JVNDB-2014-004357 // CNNVD: CNNVD-201409-737

EXTERNAL IDS

db:NVDid:CVE-2014-0990

Trust: 3.7

db:ICS CERTid:ICSA-14-261-01

Trust: 3.1

db:BIDid:69535

Trust: 2.0

db:CNNVDid:CNNVD-201409-737

Trust: 0.9

db:CNVDid:CNVD-2014-05418

Trust: 0.8

db:JVNDBid:JVNDB-2014-004357

Trust: 0.8

db:CXSECURITYid:WLB-2014090006

Trust: 0.6

db:IVDid:D27B8B38-2351-11E6-ABEF-000C29C66E3D

Trust: 0.2

db:VULHUBid:VHN-68483

Trust: 0.1

db:PACKETSTORMid:128120

Trust: 0.1

sources: IVD: d27b8b38-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-05418 // VULHUB: VHN-68483 // BID: 69535 // JVNDB: JVNDB-2014-004357 // PACKETSTORM: 128120 // CNNVD: CNNVD-201409-737 // NVD: CVE-2014-0990

REFERENCES

url:https://ics-cert.us-cert.gov/advisories/icsa-14-261-01

Trust: 3.1

url:http://www.securityfocus.com/bid/69535

Trust: 1.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0990

Trust: 0.8

url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0990

Trust: 0.8

url:http://cxsecurity.com/issue/wlb-2014090006

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2014-0987

Trust: 0.1

url:http://corelabs.coresecurity.com/

Trust: 0.1

url:http://webaccess.advantech.com/.

Trust: 0.1

url:http://www.coresecurity.com.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0988

Trust: 0.1

url:http://www.zerodayinitiative.com/advisories/published/.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0992

Trust: 0.1

url:http://www.coresecurity.com/advisories/advantech-webaccess-vulnerabilities

Trust: 0.1

url:http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0989

Trust: 0.1

url:https://github.com/coresecurity/sentinel.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0991

Trust: 0.1

url:http://www.coresecurity.com/files/attachments/core_security_advisories.asc.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0990

Trust: 0.1

url:http://corelabs.coresecurity.com.

Trust: 0.1

url:http://webaccess.advantech.com/downloads_software.php

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0986

Trust: 0.1

url:http://support.microsoft.com/kb/2458544.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0985

Trust: 0.1

sources: CNVD: CNVD-2014-05418 // VULHUB: VHN-68483 // JVNDB: JVNDB-2014-004357 // PACKETSTORM: 128120 // CNNVD: CNNVD-201409-737 // NVD: CVE-2014-0990

CREDITS

Ricardo Narvaja

Trust: 0.3

sources: BID: 69535

SOURCES

db:IVDid:d27b8b38-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2014-05418
db:VULHUBid:VHN-68483
db:BIDid:69535
db:JVNDBid:JVNDB-2014-004357
db:PACKETSTORMid:128120
db:CNNVDid:CNNVD-201409-737
db:NVDid:CVE-2014-0990

LAST UPDATE DATE

2024-08-14T13:34:45.657000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2014-05418date:2014-12-29T00:00:00
db:VULHUBid:VHN-68483date:2015-08-05T00:00:00
db:BIDid:69535date:2014-09-22T18:05:00
db:JVNDBid:JVNDB-2014-004357date:2014-09-24T00:00:00
db:CNNVDid:CNNVD-201409-737date:2014-09-22T00:00:00
db:NVDid:CVE-2014-0990date:2015-08-05T16:05:48.840

SOURCES RELEASE DATE

db:IVDid:d27b8b38-2351-11e6-abef-000c29c66e3ddate:2014-09-05T00:00:00
db:CNVDid:CNVD-2014-05418date:2014-09-05T00:00:00
db:VULHUBid:VHN-68483date:2014-09-20T00:00:00
db:BIDid:69535date:2014-09-02T00:00:00
db:JVNDBid:JVNDB-2014-004357date:2014-09-24T00:00:00
db:PACKETSTORMid:128120date:2014-09-02T22:28:11
db:CNNVDid:CNNVD-201409-737date:2014-09-22T00:00:00
db:NVDid:CVE-2014-0990date:2014-09-20T10:55:04.167