Sign-up

ID

VAR-201901-0794


CVE

CVE-2018-16196


TITLE

Yokogawa Electric Vnet/IP Service operation disruption to open communication drivers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2018-010809

DESCRIPTION

Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01.00 - R6.03.10), Exaopc(R3.10.00 - R3.75.00), PRM(R2.06.00 - R3.31.00), ProSafe-RS(R1.02.00 - R4.02.00), FAST/TOOLS(R9.02.00 - R10.02.00), B/M9000 VP(R6.03.01 - R8.01.90)) allows remote attackers to cause a denial of service attack that may result in stopping Vnet/IP Open Communication Driver's communication via unspecified vectors. Provided by Yokogawa Electric Corporation Vnet/IP For open communication drivers, disruption of service operation due to driver reception processing (DoS) Vulnerabilities (CWE-399) Exists. This vulnerability information is provided by developers for the purpose of disseminating to product users. JPCERT/CC To report to JPCERT/CC By developers and the United States ICS-CERT And adjusted.Service disruption when processing a large number of packets sent from a remote third party (DoS) State Vnet/IP The communication function of the open communication driver may stop. Yokogawa Vnet/IP Open Communication Driver is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause denial-of-service conditions. The following products are affected: Yokogawa CENTUM CS 3000 R3.05.00 through R3.09.5 Yokogawa CENTUM CS 3000 Entry Class R3.05.00 through R3.09.50 Yokogawa CENTUM VP R4.01.00 through R6.03.10 Yokogawa CENTUM VP Entry Class R4.01.00 through R6.03.10 Yokogawa Exaopc R3.10.00 through R3.75.00 Yokogawa PRM R2.06.00 through R3.31.00 Yokogawa ProSafethrough RS R1.02.00 through R4.02.00 Yokogawa FAST/TOOLS R9.02.00 through R10.02.00 Yokogawa B/M9000 VP R6.03.01 through R8.01.90. Yokogawa CENTUM CS 3000, etc. are all products of Japan's Yokogawa (Yokogawa) company. Yokogawa CENTUM CS 3000 is a large-scale production control system. Exaopc is an OPC data access server

Trust: 1.98

sources: NVD: CVE-2018-16196 // JVNDB: JVNDB-2018-010809 // BID: 106442 // VULHUB: VHN-126531

AFFECTED PRODUCTS

vendor:yokogawamodel:b\/m9000 vpscope:gteversion:r6.03.01

Trust: 1.0

vendor:yokogawamodel:centum cs 3000 entry classscope:lteversion:r3.09.50

Trust: 1.0

vendor:yokogawamodel:fast\/toolsscope:gteversion:r9.02.00

Trust: 1.0

vendor:yokogawamodel:centum vpscope:gteversion:r4.01.00

Trust: 1.0

vendor:yokogawamodel:centum cs 3000 entry classscope:gteversion:r3.05.00

Trust: 1.0

vendor:yokogawamodel:b\/m9000 vpscope:lteversion:r8.01.90

Trust: 1.0

vendor:yokogawamodel:exaopcscope:lteversion:r3.75.00

Trust: 1.0

vendor:yokogawamodel:fast\/toolsscope:lteversion:r10.02.00

Trust: 1.0

vendor:yokogawamodel:centum vp entry classscope:gteversion:r4.01.00

Trust: 1.0

vendor:yokogawamodel:plant resource managerscope:lteversion:r3.31.00

Trust: 1.0

vendor:yokogawamodel:prosafe-rsscope:lteversion:r4.02.00

Trust: 1.0

vendor:yokogawamodel:centum vpscope:lteversion:r6.03.10

Trust: 1.0

vendor:yokogawamodel:exaopcscope:gteversion:r3.10.00

Trust: 1.0

vendor:yokogawamodel:centum cs 3000scope:gteversion:r3.05.00

Trust: 1.0

vendor:yokogawamodel:centum cs 3000scope:lteversion:r3.09.50

Trust: 1.0

vendor:yokogawamodel:centum vp entry classscope:lteversion:r6.03.10

Trust: 1.0

vendor:yokogawamodel:plant resource managerscope:gteversion:r2.06.00

Trust: 1.0

vendor:yokogawamodel:prosafe-rsscope:gteversion:r1.02.00

Trust: 1.0

vendor:yokogawa electricmodel:b/m9000 vpscope:lteversion:(r6.03.01 from r8.01.90 )

Trust: 0.8

vendor:yokogawa electricmodel:centum cs 3000scope:lteversion:(r3.05.00 from r3.09.50 )

Trust: 0.8

vendor:yokogawa electricmodel:centum cs 3000scope:lteversion:small (r3.05.00 from r3.09.50 )

Trust: 0.8

vendor:yokogawa electricmodel:centum vpscope:lteversion:(r4.01.00 from r6.03.10 )

Trust: 0.8

vendor:yokogawa electricmodel:centum vpscope:lteversion:basic (r4.01.00 from r6.03.10 )

Trust: 0.8

vendor:yokogawa electricmodel:centum vpscope:lteversion:small (r4.01.00 from r6.03.10 )

Trust: 0.8

vendor:yokogawa electricmodel:exaopcscope:lteversion:(r3.10.00 from r3.75.00 )

Trust: 0.8

vendor:yokogawa electricmodel:fast/toolsscope:lteversion:(r9.02.00 from r10.02.00 )

Trust: 0.8

vendor:yokogawa electricmodel:prmscope:lteversion:(r2.06.00 from r3.31.00 )

Trust: 0.8

vendor:yokogawa electricmodel:prosafe-rsscope:lteversion:(r1.02.00 from r4.02.00 )

Trust: 0.8

vendor:yokogawamodel:prosafe-rs r4.02.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prosafe-rs r3.02.10scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prosafe-rs r2.03.80scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prosafe-rs r1.03.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prosafe-rs r1.02.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prm r3.31.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prm r3.12.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prm r3.11.20scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prm r2.06.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r9.05-sp2scope: - version: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r9.05scope: - version: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r9.04scope: - version: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r9.03scope: - version: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r9.02.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r10.02.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r10.01scope: - version: -

Trust: 0.3

vendor:yokogawamodel:exaopc r3.75.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:exaopc r3.72.10scope: - version: -

Trust: 0.3

vendor:yokogawamodel:exaopc r3.72.03scope: - version: -

Trust: 0.3

vendor:yokogawamodel:exaopc r3.72.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:exaopc r3.71.02scope: - version: -

Trust: 0.3

vendor:yokogawamodel:exaopc r3.10.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r6.03.10scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r5.04.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r5.03.51scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r5.03.20scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r5.03.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r4.03.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r4.01.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp r6.03.10scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp r5.04.20scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp r5.04.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp r4.03.56scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp r4.03.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum vp r4.01.00scope: - version: -

Trust: 0.3

vendor:yokogawamodel:centum cs entry class r3.09.50scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs entry class r3.05.00scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.09.50scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.09scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.08.70scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.08.50scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.08scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.07scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.06scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:centum cs r3.05.00scope:eqversion:3000

Trust: 0.3

vendor:yokogawamodel:b/m9000 vp r8.01.90scope: - version: -

Trust: 0.3

vendor:yokogawamodel:b/m9000 vp r8.01.01scope: - version: -

Trust: 0.3

vendor:yokogawamodel:b/m9000 vp r7.03.04scope: - version: -

Trust: 0.3

vendor:yokogawamodel:b/m9000 vp r7.03.01scope: - version: -

Trust: 0.3

vendor:yokogawamodel:b/m9000 vp r6.03.01scope: - version: -

Trust: 0.3

vendor:yokogawamodel:prosafe-rs r4.03.00scope:neversion: -

Trust: 0.3

vendor:yokogawamodel:prm r4.01.00scope:neversion: -

Trust: 0.3

vendor:yokogawamodel:fast/tools r10.03.00scope:neversion: -

Trust: 0.3

vendor:yokogawamodel:exaopc r3.76.00scope:neversion: -

Trust: 0.3

vendor:yokogawamodel:centum vp entry class r6.04.00scope:neversion: -

Trust: 0.3

vendor:yokogawamodel:centum vp r6.04.00scope:neversion: -

Trust: 0.3

sources: BID: 106442 // JVNDB: JVNDB-2018-010809 // NVD: CVE-2018-16196

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-16196
value: HIGH

Trust: 1.0

JPCERT/CC: JVNDB-2018-010809
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201901-077
value: MEDIUM

Trust: 0.6

VULHUB: VHN-126531
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-16196
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

JPCERT/CC: JVNDB-2018-010809
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-126531
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-16196
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.0

JPCERT/CC: JVNDB-2018-010809
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-126531 // JVNDB: JVNDB-2018-010809 // CNNVD: CNNVD-201901-077 // NVD: CVE-2018-16196

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.1

problemtype:CWE-399

Trust: 0.8

sources: VULHUB: VHN-126531 // JVNDB: JVNDB-2018-010809 // NVD: CVE-2018-16196

THREAT TYPE

network

Trust: 0.3

sources: BID: 106442

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201901-077

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-010809

PATCH
title:YSAR-18-0008: Vnet/IPオープン通信ドライバにサービス運用妨害(DoS)の脆弱性url:https://www.yokogawa.co.jp/library/resources/white-papers/yokogawa-security-advisory-report-list/
Trust: 0.8
title:Yokogawa Exaopc Enter the fix for the verification vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89500
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-010809 // 
            
            
            
            CNNVD: CNNVD-201901-077

EXTERNAL IDS
db:NVDid:CVE-2018-16196
Trust: 2.8
db:JVNid:JVNVU93652047
Trust: 2.5
db:BIDid:106442
Trust: 1.4
db:ICS CERTid:ICSA-19-003-02
Trust: 1.1
db:JVNDBid:JVNDB-2018-010809
Trust: 0.8
db:CNNVDid:CNNVD-201901-077
Trust: 0.7
db:SEEBUGid:SSVID-98824
Trust: 0.1
db:VULHUBid:VHN-126531
Trust: 0.1
sources:
            
            
            VULHUB: VHN-126531 // 
            
            
            
            BID: 106442 // 
            
            
            
            JVNDB: JVNDB-2018-010809 // 
            
            
            
            CNNVD: CNNVD-201901-077 // 
            
            
            
            NVD: CVE-2018-16196

REFERENCES
url:https://web-material3.yokogawa.com/ysar-18-0008-e.pdf
Trust: 2.0
url:https://jvn.jp/vu/jvnvu93652047/index.html
Trust: 1.7
url:http://www.securityfocus.com/bid/106442
Trust: 1.1
url:https://ics-cert.us-cert.gov/advisories/icsa-19-003-02
Trust: 1.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16196
Trust: 0.8
url:https://jvn.jp/vu/jvnvu93652047/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-16196
Trust: 0.8
url:https://www.yokogawa.com/in
Trust: 0.3
sources:
            
            
            VULHUB: VHN-126531 // 
            
            
            
            BID: 106442 // 
            
            
            
            JVNDB: JVNDB-2018-010809 // 
            
            
            
            CNNVD: CNNVD-201901-077 // 
            
            
            
            NVD: CVE-2018-16196

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 106442

SOURCES
db:VULHUBid:VHN-126531
db:BIDid:106442
db:JVNDBid:JVNDB-2018-010809
db:CNNVDid:CNNVD-201901-077
db:NVDid:CVE-2018-16196

LAST UPDATE DATE
2024-11-23T21:52:31.760000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-126531date:2019-02-14T00:00:00
db:BIDid:106442date:2019-12-21T00:00:00
db:JVNDBid:JVNDB-2018-010809date:2019-08-28T00:00:00
db:CNNVDid:CNNVD-201901-077date:2019-02-18T00:00:00
db:NVDid:CVE-2018-16196date:2024-11-21T03:52:16.253

SOURCES RELEASE DATE
db:VULHUBid:VHN-126531date:2019-01-09T00:00:00
db:BIDid:106442date:2019-12-21T00:00:00
db:JVNDBid:JVNDB-2018-010809date:2018-12-25T00:00:00
db:CNNVDid:CNNVD-201901-077date:2019-01-04T00:00:00
db:NVDid:CVE-2018-16196date:2019-01-09T23:29:04.560