Sign-up

ID

VAR-201709-1076


CVE

CVE-2017-9959


TITLE

Schneider Electric U.motion Builder Software Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-008210

DESCRIPTION

A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system accepts reboot in session from unauthenticated users, supporting a denial of service condition. Schneider Electric U.motion Builder Software Contains an access control vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to deny service on vulnerable installations of Schneider Electric U.motion Builder. Authentication is not required to exploit this vulnerability. The specific flaw exists within processing of message_simple_html.php, which is exposed on the web service. The reboot option of the applet reboots the system. This flaw allows a remote attacker to perpetually reboot the system, denying service to all users. U.motion Builder is a generator product from Schneider Electric, France. An SQL-injection vulnerability 2. A directory-traversal vulnerability 3. An information-disclosure vulnerability 5. A local code-execution vulnerability 6. A local denial-of-Service vulnerability 7. An information-disclosure vulnerability Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, bypass authentication mechanism, obtain sensitive information, execute arbitrary code and perform unauthorized actions. Failed exploits can result in a denial-of-service condition

Trust: 3.24

sources: NVD: CVE-2017-9959 // JVNDB: JVNDB-2017-008210 // ZDI: ZDI-17-375 // CNVD: CNVD-2017-09464 // BID: 99344 // IVD: 7a608047-a7d7-4713-925a-d716d41c34f6

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 7a608047-a7d7-4713-925a-d716d41c34f6 // CNVD: CNVD-2017-09464

AFFECTED PRODUCTS

vendor:schneider electricmodel:u.motion builderscope:lteversion:1.2.1

Trust: 1.0

vendor:schneider electricmodel:u.motion builderscope:eqversion:1.2.1

Trust: 0.9

vendor:schneider electricmodel:u.motion builder softwarescope:lteversion:1.2.1

Trust: 0.8

vendor:schneider electricmodel:u.motion builderscope: - version: -

Trust: 0.7

vendor:schneidermodel:electric u.motion builderscope: - version: -

Trust: 0.6

vendor:u motion buildermodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 7a608047-a7d7-4713-925a-d716d41c34f6 // ZDI: ZDI-17-375 // CNVD: CNVD-2017-09464 // BID: 99344 // JVNDB: JVNDB-2017-008210 // CNNVD: CNNVD-201706-1089 // NVD: CVE-2017-9959

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-9959
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-9959
value: MEDIUM

Trust: 0.8

ZDI: ZDI-17-375
value: HIGH

Trust: 0.7

CNVD: CNVD-2017-09464
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201706-1089
value: MEDIUM

Trust: 0.6

IVD: 7a608047-a7d7-4713-925a-d716d41c34f6
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2017-9959
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: ZDI-17-375
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

CNVD: CNVD-2017-09464
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7a608047-a7d7-4713-925a-d716d41c34f6
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-9959
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: IVD: 7a608047-a7d7-4713-925a-d716d41c34f6 // ZDI: ZDI-17-375 // CNVD: CNVD-2017-09464 // JVNDB: JVNDB-2017-008210 // CNNVD: CNNVD-201706-1089 // NVD: CVE-2017-9959

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-284

Trust: 0.8

sources: JVNDB: JVNDB-2017-008210 // NVD: CVE-2017-9959

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201706-1089

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201706-1089

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-008210

PATCH
title:SEVD-2017-178-01url:https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=8203873940&p_File_Name=SEVD-2017-178-01+U.motion+Builder+Software.pdf&p_Reference=SEVD-2017-178-01
Trust: 0.8
title:This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline.03/29/2016 - ZDI disclosed the vulnerability reports to ICS-CERT (with an expected 'due date' of 07/27/16).03/29/2016 - ICS-CERT acknowledged that they received them and "sent them on to our contacts at Schneider Electric, and will keep you informed of their progress.  We are tracking these issues as ICS-VU-291195."08/24/2016 - ZDI sent a follow-up inquiry to ICS-CERT requesting the status.09/08/2016 - ICS-CERT replied requesting more information on one vulnerability report, but said of the others, "they have successfully validated the rest of the vulnerability reports.  Unfortunately, they don't expect to have a patch ready until the end of this year." ICS-CERT suggested they would work with the vendor to try to bring this in.09/19/2016 - ZDI sent a follow-up inquiry to ICS-CERT asking if the vendor was anywhere closer.10/11/2016 - ZDI sent a follow-up inquiry to ICS-CERT asking if the vendor was anywhere closer and stressed potential 0-day.12/14/2016 - ZDI sent a follow-up inquiry to ICS-CERT requesting the status.06/02/2017 - ZDI sent a follow-up inquiry to ICS-CERT requesting the status.-- Mitigation:Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in  and numerous other Microsoft Knowledge Base articles.url:http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx
Trust: 0.7
title:Schneider Electric U.motion Builder Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99881
Trust: 0.6
sources:
            
            
            ZDI: ZDI-17-375 // 
            
            
            
            JVNDB: JVNDB-2017-008210 // 
            
            
            
            CNNVD: CNNVD-201706-1089

EXTERNAL IDS
db:NVDid:CVE-2017-9959
Trust: 3.5
db:SCHNEIDERid:SEVD-2017-178-01
Trust: 1.9
db:BIDid:99344
Trust: 1.9
db:ZDIid:ZDI-17-375
Trust: 1.3
db:ICS CERTid:ICSA-17-180-02
Trust: 1.1
db:CNVDid:CNVD-2017-09464
Trust: 0.8
db:CNNVDid:CNNVD-201706-1089
Trust: 0.8
db:JVNDBid:JVNDB-2017-008210
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-3646
Trust: 0.7
db:IVDid:7A608047-A7D7-4713-925A-D716D41C34F6
Trust: 0.2
sources:
            
            
            IVD: 7a608047-a7d7-4713-925a-d716d41c34f6 // 
            
            
            
            ZDI: ZDI-17-375 // 
            
            
            
            CNVD: CNVD-2017-09464 // 
            
            
            
            BID: 99344 // 
            
            
            
            JVNDB: JVNDB-2017-008210 // 
            
            
            
            CNNVD: CNNVD-201706-1089 // 
            
            
            
            NVD: CVE-2017-9959

REFERENCES
url:http://www.schneider-electric.com/en/download/document/sevd-2017-178-01/
Trust: 1.9
url:http://www.securityfocus.com/bid/99344
Trust: 1.6
url:https://ics-cert.us-cert.gov/advisories/icsa-17-180-02
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9959
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-9959
Trust: 0.8
url:http://technet.microsoft.com/en-us/library/cc725770%28ws.10%29.aspx
Trust: 0.7
url:http://www.zerodayinitiative.com/advisories/zdi-17-375/
Trust: 0.6
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
sources:
            
            
            ZDI: ZDI-17-375 // 
            
            
            
            CNVD: CNVD-2017-09464 // 
            
            
            
            BID: 99344 // 
            
            
            
            JVNDB: JVNDB-2017-008210 // 
            
            
            
            CNNVD: CNNVD-201706-1089 // 
            
            
            
            NVD: CVE-2017-9959

CREDITS
rgod
Trust: 0.7
sources:
            
            
            ZDI: ZDI-17-375

SOURCES
db:IVDid:7a608047-a7d7-4713-925a-d716d41c34f6
db:ZDIid:ZDI-17-375
db:CNVDid:CNVD-2017-09464
db:BIDid:99344
db:JVNDBid:JVNDB-2017-008210
db:CNNVDid:CNNVD-201706-1089
db:NVDid:CVE-2017-9959

LAST UPDATE DATE
2024-11-23T20:24:58.245000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-17-375date:2017-06-12T00:00:00
db:CNVDid:CNVD-2017-09464date:2017-06-14T00:00:00
db:BIDid:99344date:2017-06-30T00:00:00
db:JVNDBid:JVNDB-2017-008210date:2019-01-09T00:00:00
db:CNNVDid:CNNVD-201706-1089date:2019-10-23T00:00:00
db:NVDid:CVE-2017-9959date:2024-11-21T03:37:15.280

SOURCES RELEASE DATE
db:IVDid:7a608047-a7d7-4713-925a-d716d41c34f6date:2017-06-14T00:00:00
db:ZDIid:ZDI-17-375date:2017-06-12T00:00:00
db:CNVDid:CNVD-2017-09464date:2017-06-14T00:00:00
db:BIDid:99344date:2017-06-30T00:00:00
db:JVNDBid:JVNDB-2017-008210date:2017-10-12T00:00:00
db:CNNVDid:CNNVD-201706-1089date:2017-06-27T00:00:00
db:NVDid:CVE-2017-9959date:2017-09-26T01:29:03.927