Details of VAR-201803-2214

ID

VAR-201803-2214

CVE

CVE-2018-7521

TITLE

OMRON CX-Supervisor SCS File Parsing Use-After-Free Remote Code Execution Vulnerability

Trust: 5.6

sources: ZDI: ZDI-18-1352 // ZDI: ZDI-18-257 // ZDI: ZDI-18-1354 // ZDI: ZDI-18-251 // ZDI: ZDI-18-259 // ZDI: ZDI-18-258 // ZDI: ZDI-18-1351 // ZDI: ZDI-18-1353

DESCRIPTION

In Omron CX-Supervisor Versions 3.30 and prior, use after free vulnerabilities can be exploited when CX Supervisor parses a specially crafted project file. Provided by OMRON Corporation CX-Supervisor Contains the following multiple vulnerabilities: * * Stack-based buffer overflow (CWE-121) - CVE-2018-7513 ∙ Stack-based buffer overflow may occur due to processing of specially crafted project files. * * Uninitialized pointer access (CWE-824) - CVE-2018-7515 There is a possibility of accessing an uninitialized pointer due to the processing of a specially crafted packet. * * Write outside memory boundary (CWE-787) - CVE-2018-7517 ∙ There is a possibility of writing outside the memory boundary due to processing of a specially crafted project file. * * Memory double release (CWE-415) - CVE-2018-7523 This is a memory double release vulnerability caused by processing of specially crafted project files. * * Untrusted pointer reference (CWE-822) - CVE-2018-7525 There is a possibility of referring to untrusted pointers due to processing of specially crafted packets.A remote attacker could execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OMRON CX-Supervisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of project files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. CX-Supervisor is a Miscellaneous Shareware software. CX-Supervisor is dedicated to the design and operation of PC visualization and machine control. There is a free use vulnerability in the Omron CX-Supervisor 3.30 version. Omron CX-Supervisor is prone to the following security vulnerabilities: 1. A stack-based buffer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability 3. Omron CX-Supervisor Versions 3.30 and prior are vulnerable; other versions may also be affected. Omron CX-Supervisor is a visual machine controller produced by Omron Corporation of Japan

Trust: 8.37

sources: NVD: CVE-2018-7521 // JVNDB: JVNDB-2018-001951 // ZDI: ZDI-18-1352 // ZDI: ZDI-18-257 // ZDI: ZDI-18-1354 // ZDI: ZDI-18-251 // ZDI: ZDI-18-259 // ZDI: ZDI-18-255 // ZDI: ZDI-18-258 // ZDI: ZDI-18-1351 // ZDI: ZDI-18-1353 // CNVD: CNVD-2018-05316 // BID: 103394 // IVD: e2e65ed2-39ab-11e9-a8dd-000c29342cb1 // VULHUB: VHN-137553

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: e2e65ed2-39ab-11e9-a8dd-000c29342cb1 // CNVD: CNVD-2018-05316

AFFECTED PRODUCTS

vendor:	omron	model:	cx-supervisor	scope:	-	version:	-	Trust: 6.3
vendor:	omron	model:	cx-supervisor	scope:	lte	version:	3.30	Trust: 1.0
vendor:	omron	model:	cx-supervisor	scope:	eq	version:	3.30	Trust: 0.9
vendor:	omron	model:	cx-supervisor	scope:	lte	version:	version 3.30	Trust: 0.8
vendor:	omron	model:	cx-supervisor	scope:	lte	version:	<=3.30	Trust: 0.6
vendor:	omron	model:	cx-supervisor	scope:	ne	version:	3.4.1	Trust: 0.3
vendor:	cx supervisor	model:	-	scope:	eq	version:	*	Trust: 0.2

CVSS

SEVERITY

CVSSV2

CVSSV3

JPCERT/CC:	JVNDB-2018-001951
value:	MEDIUM
Trust: 5.6
ZDI:	CVE-2018-7521
value:	MEDIUM
Trust: 3.5
ZDI:	CVE-2018-7521
value:	HIGH
Trust: 2.1
nvd@nist.gov:	CVE-2018-7521
value:	MEDIUM
Trust: 1.0
ZDI:	CVE-2018-7521
value:	CRITICAL
Trust: 0.7
CNVD:	CNVD-2018-05316
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201803-652
value:	MEDIUM
Trust: 0.6
IVD:	e2e65ed2-39ab-11e9-a8dd-000c29342cb1
value:	MEDIUM
Trust: 0.2
VULHUB:	VHN-137553
value:	MEDIUM
Trust: 0.1

JPCERT/CC:	JVNDB-2018-001951
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 5.6
ZDI:	CVE-2018-7521
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 3.5
nvd@nist.gov:	CVE-2018-7521
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
CNVD:	CNVD-2018-05316
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	e2e65ed2-39ab-11e9-a8dd-000c29342cb1
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-137553
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

JPCERT/CC:	JVNDB-2018-001951
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 5.6
ZDI:	CVE-2018-7521
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 2.1
nvd@nist.gov:	CVE-2018-7521
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.8
impactScore:	3.4
version:	3.0
Trust: 1.0
ZDI:	CVE-2018-7521
baseSeverity:	CRITICAL
baseScore:	7.0
vectorString:	AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.0
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: IVD: e2e65ed2-39ab-11e9-a8dd-000c29342cb1 // ZDI: ZDI-18-1352 // ZDI: ZDI-18-257 // ZDI: ZDI-18-1354 // ZDI: ZDI-18-251 // ZDI: ZDI-18-259 // ZDI: ZDI-18-255 // ZDI: ZDI-18-258 // ZDI: ZDI-18-1351 // ZDI: ZDI-18-1353 // CNVD: CNVD-2018-05316 // VULHUB: VHN-137553 // JVNDB: JVNDB-2018-001951 // JVNDB: JVNDB-2018-001951 // JVNDB: JVNDB-2018-001951 // JVNDB: JVNDB-2018-001951 // JVNDB: JVNDB-2018-001951 // JVNDB: JVNDB-2018-001951 // JVNDB: JVNDB-2018-001951 // CNNVD: CNNVD-201803-652 // NVD: CVE-2018-7521

PROBLEMTYPE DATA

problemtype:	CWE-416	Trust: 1.9
problemtype:	CWE-121	Trust: 0.8
problemtype:	CWE-122	Trust: 0.8
problemtype:	CWE-787	Trust: 0.8
problemtype:	CWE-824	Trust: 0.8
problemtype:	CWE-822	Trust: 0.8
problemtype:	CWE-415	Trust: 0.8

sources: VULHUB: VHN-137553 // JVNDB: JVNDB-2018-001951 // NVD: CVE-2018-7521

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201803-652

TYPE

Resource management error

Trust: 0.8

sources: IVD: e2e65ed2-39ab-11e9-a8dd-000c29342cb1 // CNNVD: CNNVD-201803-652

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-001951

PATCH

title:	Omron has issued an update to correct this vulnerability.	url:	https://ics-cert.us-cert.gov/advisories/ICSA-18-072-01	Trust: 6.3
title:	Release Notes For CX-Supervisor 3.4.1	url:	https://www.myomron.com/index.php?action=kb&article=1707	Trust: 0.8
title:	Omron CX-Supervisor free use of vulnerable patches	url:	https://www.cnvd.org.cn/patchInfo/show/121533	Trust: 0.6
title:	Omron CX-Supervisor Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79271	Trust: 0.6

sources: ZDI: ZDI-18-1352 // ZDI: ZDI-18-257 // ZDI: ZDI-18-1354 // ZDI: ZDI-18-251 // ZDI: ZDI-18-259 // ZDI: ZDI-18-255 // ZDI: ZDI-18-258 // ZDI: ZDI-18-1351 // ZDI: ZDI-18-1353 // CNVD: CNVD-2018-05316 // JVNDB: JVNDB-2018-001951 // CNNVD: CNNVD-201803-652

EXTERNAL IDS

db:	NVD	id:	CVE-2018-7521	Trust: 9.9
db:	ICS CERT	id:	ICSA-18-072-01	Trust: 3.4
db:	BID	id:	103394	Trust: 2.0
db:	CNNVD	id:	CNNVD-201803-652	Trust: 0.9
db:	CNVD	id:	CNVD-2018-05316	Trust: 0.8
db:	JVN	id:	JVNVU95051832	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-001951	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-6687	Trust: 0.7
db:	ZDI	id:	ZDI-18-1352	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5306	Trust: 0.7
db:	ZDI	id:	ZDI-18-257	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-6711	Trust: 0.7
db:	ZDI	id:	ZDI-18-1354	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5300	Trust: 0.7
db:	ZDI	id:	ZDI-18-251	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5308	Trust: 0.7
db:	ZDI	id:	ZDI-18-259	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5304	Trust: 0.7
db:	ZDI	id:	ZDI-18-255	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5307	Trust: 0.7
db:	ZDI	id:	ZDI-18-258	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-6663	Trust: 0.7
db:	ZDI	id:	ZDI-18-1351	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-6691	Trust: 0.7
db:	ZDI	id:	ZDI-18-1353	Trust: 0.7
db:	IVD	id:	E2E65ED2-39AB-11E9-A8DD-000C29342CB1	Trust: 0.2
db:	VULHUB	id:	VHN-137553	Trust: 0.1

sources: IVD: e2e65ed2-39ab-11e9-a8dd-000c29342cb1 // ZDI: ZDI-18-1352 // ZDI: ZDI-18-257 // ZDI: ZDI-18-1354 // ZDI: ZDI-18-251 // ZDI: ZDI-18-259 // ZDI: ZDI-18-255 // ZDI: ZDI-18-258 // ZDI: ZDI-18-1351 // ZDI: ZDI-18-1353 // CNVD: CNVD-2018-05316 // VULHUB: VHN-137553 // BID: 103394 // JVNDB: JVNDB-2018-001951 // CNNVD: CNNVD-201803-652 // NVD: CVE-2018-7521

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-18-072-01	Trust: 9.7
url:	http://www.securityfocus.com/bid/103394	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7517	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7519	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7521	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7523	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7525	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7513	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7515	Trust: 0.8
url:	https://ics-cert.us-cert.gov/recommended-practices	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu95051832/index.html	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7515	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7517	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7519	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7521	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7523	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7525	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7513	Trust: 0.8
url:	https://industrial.omron.eu/	Trust: 0.3

sources: ZDI: ZDI-18-1352 // ZDI: ZDI-18-257 // ZDI: ZDI-18-1354 // ZDI: ZDI-18-251 // ZDI: ZDI-18-259 // ZDI: ZDI-18-255 // ZDI: ZDI-18-258 // ZDI: ZDI-18-1351 // ZDI: ZDI-18-1353 // CNVD: CNVD-2018-05316 // VULHUB: VHN-137553 // BID: 103394 // JVNDB: JVNDB-2018-001951 // CNNVD: CNNVD-201803-652 // NVD: CVE-2018-7521

CREDITS

rgod

Trust: 3.5

sources: ZDI: ZDI-18-257 // ZDI: ZDI-18-251 // ZDI: ZDI-18-259 // ZDI: ZDI-18-255 // ZDI: ZDI-18-258

SOURCES

db:	IVD	id:	e2e65ed2-39ab-11e9-a8dd-000c29342cb1
db:	ZDI	id:	ZDI-18-1352
db:	ZDI	id:	ZDI-18-257
db:	ZDI	id:	ZDI-18-1354
db:	ZDI	id:	ZDI-18-251
db:	ZDI	id:	ZDI-18-259
db:	ZDI	id:	ZDI-18-255
db:	ZDI	id:	ZDI-18-258
db:	ZDI	id:	ZDI-18-1351
db:	ZDI	id:	ZDI-18-1353
db:	CNVD	id:	CNVD-2018-05316
db:	VULHUB	id:	VHN-137553
db:	BID	id:	103394
db:	JVNDB	id:	JVNDB-2018-001951
db:	CNNVD	id:	CNNVD-201803-652
db:	NVD	id:	CVE-2018-7521

LAST UPDATE DATE

2024-11-23T21:39:28.567000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-18-1352	date:	2018-11-21T00:00:00
db:	ZDI	id:	ZDI-18-257	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-1354	date:	2018-11-21T00:00:00
db:	ZDI	id:	ZDI-18-251	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-259	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-255	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-258	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-1351	date:	2018-11-21T00:00:00
db:	ZDI	id:	ZDI-18-1353	date:	2018-11-21T00:00:00
db:	CNVD	id:	CNVD-2018-05316	date:	2018-03-15T00:00:00
db:	VULHUB	id:	VHN-137553	date:	2019-10-09T00:00:00
db:	BID	id:	103394	date:	2018-03-13T00:00:00
db:	JVNDB	id:	JVNDB-2018-001951	date:	2018-08-22T00:00:00
db:	CNNVD	id:	CNNVD-201803-652	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-7521	date:	2024-11-21T04:12:17.387

SOURCES RELEASE DATE

db:	IVD	id:	e2e65ed2-39ab-11e9-a8dd-000c29342cb1	date:	2018-03-15T00:00:00
db:	ZDI	id:	ZDI-18-1352	date:	2018-11-21T00:00:00
db:	ZDI	id:	ZDI-18-257	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-1354	date:	2018-11-21T00:00:00
db:	ZDI	id:	ZDI-18-251	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-259	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-255	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-258	date:	2018-03-23T00:00:00
db:	ZDI	id:	ZDI-18-1351	date:	2018-11-21T00:00:00
db:	ZDI	id:	ZDI-18-1353	date:	2018-11-21T00:00:00
db:	CNVD	id:	CNVD-2018-05316	date:	2018-03-15T00:00:00
db:	VULHUB	id:	VHN-137553	date:	2018-03-21T00:00:00
db:	BID	id:	103394	date:	2018-03-13T00:00:00
db:	JVNDB	id:	JVNDB-2018-001951	date:	2018-03-16T00:00:00
db:	CNNVD	id:	CNNVD-201803-652	date:	2018-03-19T00:00:00
db:	NVD	id:	CVE-2018-7521	date:	2018-03-21T20:29:01.293