Details of VAR-201601-0134

ID

VAR-201601-0134

CVE

CVE-2015-6467

TITLE

Advantech WebAccess Arbitrary code execution vulnerability

Trust: 1.4

sources: IVD: 64df8e80-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-00429 // CNNVD: CNNVD-201601-323

DESCRIPTION

Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin. WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation equipment in facility management systems, power stations and building automation systems. Advantech WebAccess is prone to following security vulnerabilities: 1. A denial-of-service vulnerability 2. An arbitrary file-upload vulnerability 3. A directory-traversal vulnerability 4. Multiple stack-based buffer-overflow vulnerabilities 5. A heap-based buffer overflow vulnerability 6. Multiple buffer-overflow vulnerabilities 7. Multiple information disclosure vulnerabilities 8. A cross-site scripting vulnerability 9. An SQL-injection vulnerability 10. A cross-site request forgery vulnerability 11. A remote-code execution vulnerability An attacker can exploit these issues to execute arbitrary code in the context of the application, cause a denial-of-service condition, upload arbitrary files, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to use directory-traversal sequences ('../') to retrieve arbitrary files, obtain sensitive information and perform certain unauthorized actions. This may aid in further attacks. Advantech WebAccess 8.0 and prior versions are vulnerable. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech

Trust: 2.7

sources: NVD: CVE-2015-6467 // JVNDB: JVNDB-2015-006787 // CNVD: CNVD-2016-00429 // BID: 80745 // IVD: 64df8e80-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-84428

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 64df8e80-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-00429

AFFECTED PRODUCTS

vendor:	advantech	model:	webaccess	scope:	lt	version:	8.1	Trust: 1.4
vendor:	advantech	model:	webaccess	scope:	lte	version:	8.0	Trust: 1.0
vendor:	advantech	model:	webaccess	scope:	eq	version:	8.0	Trust: 0.6
vendor:	advantech	model:	webaccess	scope:	eq	version:	8	Trust: 0.3
vendor:	advantech	model:	webaccess	scope:	eq	version:	7.2	Trust: 0.3
vendor:	advantech	model:	webaccess	scope:	ne	version:	8.1	Trust: 0.3
vendor:	webaccess	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 64df8e80-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-00429 // BID: 80745 // JVNDB: JVNDB-2015-006787 // CNNVD: CNNVD-201601-323 // NVD: CVE-2015-6467

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-6467
value:	HIGH
Trust: 1.0
NVD:	CVE-2015-6467
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2016-00429
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201601-323
value:	CRITICAL
Trust: 0.6
IVD:	64df8e80-2351-11e6-abef-000c29c66e3d
value:	CRITICAL
Trust: 0.2
VULHUB:	VHN-84428
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-6467
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-00429
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	64df8e80-2351-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-84428
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-6467
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.2
impactScore:	5.9
version:	3.0
Trust: 1.0

sources: IVD: 64df8e80-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-00429 // VULHUB: VHN-84428 // JVNDB: JVNDB-2015-006787 // CNNVD: CNNVD-201601-323 // NVD: CVE-2015-6467

PROBLEMTYPE DATA

problemtype:

NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2015-6467

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-323

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201601-323

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-006787

PATCH

title:	Advantech WebAccess	url:	http://www.advantech.com/industrial-automation/webaccess	Trust: 0.8
title:	Patch for Advantech WebAccess arbitrary code execution vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/70374	Trust: 0.6
title:	Advantech WebAccess Fixes for arbitrary code execution vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59641	Trust: 0.6

sources: CNVD: CNVD-2016-00429 // JVNDB: JVNDB-2015-006787 // CNNVD: CNNVD-201601-323

EXTERNAL IDS

db:	NVD	id:	CVE-2015-6467	Trust: 3.6
db:	ICS CERT	id:	ICSA-16-014-01	Trust: 2.8
db:	CNNVD	id:	CNNVD-201601-323	Trust: 0.9
db:	CNVD	id:	CNVD-2016-00429	Trust: 0.8
db:	JVNDB	id:	JVNDB-2015-006787	Trust: 0.8
db:	BID	id:	80745	Trust: 0.3
db:	IVD	id:	64DF8E80-2351-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	VULHUB	id:	VHN-84428	Trust: 0.1

sources: IVD: 64df8e80-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-00429 // VULHUB: VHN-84428 // BID: 80745 // JVNDB: JVNDB-2015-006787 // CNNVD: CNNVD-201601-323 // NVD: CVE-2015-6467

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-16-014-01	Trust: 2.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6467	Trust: 1.4
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6467	Trust: 0.8
url:	http://webaccess.advantech.com	Trust: 0.3

sources: CNVD: CNVD-2016-00429 // VULHUB: VHN-84428 // BID: 80745 // JVNDB: JVNDB-2015-006787 // CNNVD: CNNVD-201601-323 // NVD: CVE-2015-6467

CREDITS

Ilya Karpov of Positive Technologies, Ivan Sanchez, Andrea Micalizzi, Ariele Caltabiano, Fritz Sands, Steven Seeley, and an anonymous researcher

Trust: 0.3

sources: BID: 80745

SOURCES

db:	IVD	id:	64df8e80-2351-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2016-00429
db:	VULHUB	id:	VHN-84428
db:	BID	id:	80745
db:	JVNDB	id:	JVNDB-2015-006787
db:	CNNVD	id:	CNNVD-201601-323
db:	NVD	id:	CVE-2015-6467

LAST UPDATE DATE

2024-08-14T13:33:09.175000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-00429	date:	2016-01-25T00:00:00
db:	VULHUB	id:	VHN-84428	date:	2016-01-20T00:00:00
db:	BID	id:	80745	date:	2016-01-14T00:00:00
db:	JVNDB	id:	JVNDB-2015-006787	date:	2016-01-21T00:00:00
db:	CNNVD	id:	CNNVD-201601-323	date:	2016-01-18T00:00:00
db:	NVD	id:	CVE-2015-6467	date:	2016-01-20T19:52:34.567

SOURCES RELEASE DATE

db:	IVD	id:	64df8e80-2351-11e6-abef-000c29c66e3d	date:	2016-01-25T00:00:00
db:	CNVD	id:	CNVD-2016-00429	date:	2016-01-25T00:00:00
db:	VULHUB	id:	VHN-84428	date:	2016-01-15T00:00:00
db:	BID	id:	80745	date:	2016-01-14T00:00:00
db:	JVNDB	id:	JVNDB-2015-006787	date:	2016-01-21T00:00:00
db:	CNNVD	id:	CNNVD-201601-323	date:	2016-01-18T00:00:00
db:	NVD	id:	CVE-2015-6467	date:	2016-01-15T03:59:09.887