Details of VAR-201903-0652

ID

VAR-201903-0652

CVE

CVE-2014-9189

TITLE

Honeywell Experion PKS Module buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-008656

DESCRIPTION

Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. Honeywell Experion PKS The module contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Honeywell EPKS is used in the automation and control of industrial and production processes and is a distributed control system solution, including a web-based SCADA system. Honeywell Experion PKS has multiple stack buffer overflow vulnerabilities because the application failed to properly check the user-supplied data before copying it to a full-size buffer. A remote attacker could exploit these vulnerabilities to execute arbitrary code or cause dynamic memory corruption in the context of an affected application. Failed attempts will likely cause a denial-of-service condition. The following versions are affected: Honeywell Experion R40x versions prior to Experion PKS R400.6 Honeywell Experion R41x versions prior to Experion PKS R410.6 Honeywell Experion R43x versions prior to Experion PKS R430.2. The vulnerability is due to insufficient boundary checks performed on the user-supplied input by the affected software. An attacker could exploit this vulnerability by sending a crafted request to the affected software. Honeywell has confirmed this vulnerability and released updated software

Trust: 2.7

sources: NVD: CVE-2014-9189 // JVNDB: JVNDB-2014-008656 // CNVD: CNVD-2014-09120 // BID: 71740 // IVD: b3c01fa6-2351-11e6-abef-000c29c66e3d // VULMON: CVE-2014-9189

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: b3c01fa6-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-09120

AFFECTED PRODUCTS

vendor:	honeywell	model:	experion process knowledge system	scope:	lt	version:	r400.6	Trust: 1.8
vendor:	honeywell	model:	experion process knowledge system	scope:	lt	version:	r410.6	Trust: 1.8
vendor:	honeywell	model:	experion process knowledge system	scope:	lt	version:	r430.2	Trust: 1.8
vendor:	honeywell	model:	experion process knowledge system	scope:	gte	version:	r400	Trust: 1.0
vendor:	honeywell	model:	experion process knowledge system	scope:	gte	version:	r410	Trust: 1.0
vendor:	honeywell	model:	experion process knowledge system	scope:	gte	version:	r430	Trust: 1.0
vendor:	experion process knowledge system	model:	-	scope:	eq	version:	*	Trust: 0.6
vendor:	honeywell	model:	experion pks r40x	scope:	-	version:	-	Trust: 0.6
vendor:	honeywell	model:	experion pks r41x	scope:	-	version:	-	Trust: 0.6
vendor:	honeywell	model:	experion pks r43x	scope:	-	version:	-	Trust: 0.6
vendor:	honeywell	model:	experion pks r430.1	scope:	-	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r430	scope:	-	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r410.5	scope:	-	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r410	scope:	-	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r400.5	scope:	-	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r400	scope:	-	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r430.2	scope:	ne	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r410.6	scope:	ne	version:	-	Trust: 0.3
vendor:	honeywell	model:	experion pks r400.6	scope:	ne	version:	-	Trust: 0.3

sources: IVD: b3c01fa6-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-09120 // BID: 71740 // JVNDB: JVNDB-2014-008656 // NVD: CVE-2014-9189

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-9189
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2014-9189
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2014-09120
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201412-513
value:	CRITICAL
Trust: 0.6
IVD:	b3c01fa6-2351-11e6-abef-000c29c66e3d
value:	CRITICAL
Trust: 0.2
VULMON:	CVE-2014-9189
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2014-9189
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2014-09120
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	b3c01fa6-2351-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2014-9189
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: IVD: b3c01fa6-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-09120 // VULMON: CVE-2014-9189 // JVNDB: JVNDB-2014-008656 // CNNVD: CNNVD-201412-513 // NVD: CVE-2014-9189

PROBLEMTYPE DATA

problemtype:	CWE-119	Trust: 1.8
problemtype:	CWE-121	Trust: 1.0

sources: JVNDB: JVNDB-2014-008656 // NVD: CVE-2014-9189

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201412-513

TYPE

Buffer error

Trust: 0.8

sources: IVD: b3c01fa6-2351-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201412-513

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-008656

PATCH

title:	Experion PKS	url:	https://www.honeywellprocess.com/en-US/explore/products/control-monitoring-and-safety-systems/integrated-control-and-safety-systems/experion-pks/Pages/default.aspx	Trust: 0.8
title:	Honeywell Experion PKS has multiple patches for stack buffer overflow vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/53120	Trust: 0.6
title:	Honeywell Experion PKS Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90836	Trust: 0.6

sources: CNVD: CNVD-2014-09120 // JVNDB: JVNDB-2014-008656 // CNNVD: CNNVD-201412-513

EXTERNAL IDS

db:	NVD	id:	CVE-2014-9189	Trust: 3.6
db:	ICS CERT	id:	ICSA-14-352-01	Trust: 2.8
db:	BID	id:	71740	Trust: 0.9
db:	CNVD	id:	CNVD-2014-09120	Trust: 0.8
db:	CNNVD	id:	CNNVD-201412-513	Trust: 0.8
db:	JVNDB	id:	JVNDB-2014-008656	Trust: 0.8
db:	IVD	id:	B3C01FA6-2351-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	VULMON	id:	CVE-2014-9189	Trust: 0.1

sources: IVD: b3c01fa6-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2014-09120 // VULMON: CVE-2014-9189 // BID: 71740 // JVNDB: JVNDB-2014-008656 // CNNVD: CNNVD-201412-513 // NVD: CVE-2014-9189

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-14-352-01	Trust: 2.9
url:	https://nvd.nist.gov/vuln/detail/cve-2014-9189	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9189	Trust: 0.8
url:	http://www.securityfocus.com/bid/71740	Trust: 0.6
url:	https://www.honeywellprocess.com/en-us/training/programs/control-monitoring-and-safety-systems/pages/experion-pks.aspx	Trust: 0.3
url:	http://s1018729.instanturl.net/wp-content/uploads/2013/01/overview_epdoc-xx81-en-410.pdf	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=36830	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2014-09120 // VULMON: CVE-2014-9189 // BID: 71740 // JVNDB: JVNDB-2014-008656 // CNNVD: CNNVD-201412-513 // NVD: CVE-2014-9189

CREDITS

Kirill Nesterov,Alexander Tlyapov, Gleb Gritsai, Artem Chaykin and Ilya Karpov of the Positive Technologies Research Team and Security Lab

Trust: 0.6

sources: CNNVD: CNNVD-201412-513

SOURCES

db:	IVD	id:	b3c01fa6-2351-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2014-09120
db:	VULMON	id:	CVE-2014-9189
db:	BID	id:	71740
db:	JVNDB	id:	JVNDB-2014-008656
db:	CNNVD	id:	CNNVD-201412-513
db:	NVD	id:	CVE-2014-9189

LAST UPDATE DATE

2024-08-14T13:55:35.414000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2014-09120	date:	2014-12-26T00:00:00
db:	VULMON	id:	CVE-2014-9189	date:	2019-10-09T00:00:00
db:	BID	id:	71740	date:	2014-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2014-008656	date:	2019-05-10T00:00:00
db:	CNNVD	id:	CNNVD-201412-513	date:	2019-04-10T00:00:00
db:	NVD	id:	CVE-2014-9189	date:	2019-10-09T23:12:24.530

SOURCES RELEASE DATE

db:	IVD	id:	b3c01fa6-2351-11e6-abef-000c29c66e3d	date:	2014-12-25T00:00:00
db:	CNVD	id:	CNVD-2014-09120	date:	2014-12-25T00:00:00
db:	VULMON	id:	CVE-2014-9189	date:	2019-03-25T00:00:00
db:	BID	id:	71740	date:	2014-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2014-008656	date:	2019-05-10T00:00:00
db:	CNNVD	id:	CNNVD-201412-513	date:	2014-12-25T00:00:00
db:	NVD	id:	CVE-2014-9189	date:	2019-03-25T20:29:00.300