Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
70 vulnerabilities by Gemalto
VAR-201710-0668
Vulnerability from variot - Updated: 2023-12-18 13:48The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS. This vulnerability is often cited as "ROCA" in the media. Infineon Made RSA The library contains RSA There is a problem that does not generate the key pair properly. As a result, generated using this library RSA The private key corresponding to the public key may be obtained. Cryptographic issues (CWE-310) - CVE-2017-15361 Infineon Made RSA The library contains RSA There is a problem that does not generate the key pair properly. Using the library RSA When generating a key pair, a more efficient search method than the exhaustive key search can be applied. at least 2048 There is a possibility of obtaining a secret key with a key length of less than or equal to bits. This attack was generated by the library RSA It can be applied simply by obtaining a public key. In addition, this case RSA Problem with key generation ECC ( Elliptic curve cryptography ) Is not affected. Also generated by other devices and libraries RSA key Can also be used safely with this library. The library is Trusted Platform Modules (TPM) Or a smart card. Information on affected vendors is available on the developer's site. For details, refer to the information published by the discoverer. Developer site https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160 Information published by the discoverer https://crocs.fi.muni.cz/public/papers/rsa_ccs17Using the library RSA If a key is generated, there is a possibility that a private key may be obtained by a remote third party. An attacker could exploit this vulnerability to compromise the encryption protection mechanism. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03789en_us
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: hpesbhf03789en_us Version: 2
HPESBHF03789 rev.2 - Certain HPE Gen9 Systems with HP Trusted Platform Module v2.0 Option, Unauthorized Access to Data
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2017-10-18 Last Updated: 2017-10-17
Potential Security Impact: Local: Unauthorized Access to Data; Remote: Unauthorized Access to Data
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY A potential security vulnerability has been identified in the "HP Trusted Platform Module 2.0 Option" kit. This optional kit is available for HPE Gen9 systems with firmware version 5.51. The vulnerability in TPM firmware 5.51 is that new mathematical methods exist such that RSA keys generated by the TPM 2.0 with firmware 5.51 are cryptographically weakened. This vulnerability could lead to local and remote unauthorized access to data.
References:
- PSRT110605
- PSRT110598
- CVE-2017-15361
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. This is the Gen9 TPM 2.0 option (only Gen9 servers could have this option). The TPM 2.0 Option for Gen9 servers is not standard on Gen9 servers - - it is an option. - HP ProLiant BL460c Gen9 Server Blade n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant BL660c Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL120 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL160 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL360 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL380 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL388 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL580 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL60 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant DL80 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant ML110 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HP ProLiant ML150 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE Apollo 4200 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant DL180 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant DL180 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant DL20 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant DL560 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML10 Gen9 E3-1225 v5 3.3GHz 4-core 8GB-R 1TB Non-hot Plug 4LFF SATA 300W AP Svr/Promo n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML10 Gen9 E3-1225 v5 4GB-R 1TB Non-hot Plug 4LFF SATA 300W Svr/S-Buy n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 1TB Non-hot Plug 4LFF SATA 300W Perf Svr n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 2TB Non-hot Plug 4LFF SATA 300W Svr/GO n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 2TB Non-hot Plug 4LFF SATA 300W Svr/TV n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML10 Gen9 G4400 4GB-R Non-hot Plug 4LFF SATA 300W Entry Svr n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML30 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML350 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant ML350 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL170r Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL190r Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL230a Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL230a Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL250a Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL250a Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL260a Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL450 Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL730f Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL730f Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL740f Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL740f Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL750f Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed. - HPE ProLiant XL750f Gen9 Server n/a - only if "HPE Trusted Platform Module 2.0 Kit" w/ FW version 5.51 is installed.
BACKGROUND
CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
CVE-2017-15361
7.4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)
Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499
RESOLUTION
HPE has provided both an updated system ROM, and updated TPM firmware to correct this issue for impacted systems. Update the system ROM and "HPE Trusted Platform Module 2.0 Option" to firmware version 5.62 or subsequent.
The latest version of the System ROM is available, and must be updated before updating the TPM firmware. Use these instructions:
1.Click the following link:
2.Enter a product name (e.g., "DL380 Gen9") in the text field under Enter a
Product Name or Number.
3.Click Go.
4.Select the appropriate product model from the Results list (if prompted).
5.Click the "drivers, software & firmware" hyperlink under the Download
Options tab.
6.Select the system's specific operating system from the Operating Systems
dropdown menu.
7.Click the category BIOS - System ROM.
8.Select the latest release of HPE System ROM Version 2.50 (or later).
9.Click Download.
The latest version of the TPM firmware is available. Use these instructions:
1.Click the following link:
2.Enter a product name (e.g., "DL380 Gen9") in the text field under Enter a
Product Name or Number.
3.Click Go.
4.Select the appropriate product model from the Results list (if prompted).
5.Click the "drivers, software & firmware" hyperlink under the Download
Options tab.
6.Select the system's specific operating system from the Operating Systems
dropdown menu.
7.Click the category Firmware.
8.Select the latest release of the HPE Trusted Platform Module 2.0 Option
firmware update for HPE Gen9 Severs Version 5.62 (or later).
9.Click Download.
Note:
-
After the firmware upgrade, the TPM will generate RSA keys using an improved algorithm. Revoking the weak TPM generated RSA keys will still be required. Refer to the OS documentation for OS-specific instructions. In addition, a System ROM update to version 2.50 (or later) is required before updating the TPM 2.0 firmware.
-
Please refer to the HPE Customer Bulletin as well:
-
HPE ProLiant Gen9 Servers - Potential Vulnerability in the HPE Trusted Platform Module 2.0 Option Firmware Version 5.51 for HPE ProLiant Gen9 Servers http://h20565.www2.hpe.com/hpsc/doc/public/display?docId=a00028289en_us
HISTORY
Version:1 (rev.1) - 16 October 2017 Initial release
Version:2 (rev.2) - 17 October 2017 Added CVE reference
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBCAAGBQJZ5k72AAoJELXhAxt7SZaiU4EIAKJK3i30Qui8Fqm7/Kr5R/oB UgW8kg/4EkbEpJ7ewQwjE2gaIMUmo6q2we+mpLU3/4T8+ZcZgxw7hDZqOrOn7V08 rzchXK1oLqdW9vu0BlWrUK6TTWHghW38nwqLHhmxuRavrVR4kYB+ctfFUS3vaSVd eQWBn6coSrkeToazgtvlPilChl1ygH4NITmLBXPnSbcp8U1yLhF+j0eUKLcZnR8l OMi65CVCNWCcSL3NV6x4NXvREmehKXGqgokGUe6rBWucU+A21W66GhsnhC5ysa4j SR8Ungf0W1QihfW3+Jijiu5hC7mrcZrGi+AZAvJDb4S5zvfM+hVUZNuEGa6nzVM= =KoaT -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0668",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "trusted platform",
"scope": "eq",
"trust": 1.6,
"vendor": "infineon",
"version": "4.31"
},
{
"model": "trusted platform",
"scope": "eq",
"trust": 1.6,
"vendor": "infineon",
"version": "133.32"
},
{
"model": "trusted platform",
"scope": "eq",
"trust": 1.6,
"vendor": "infineon",
"version": "6.40"
},
{
"model": "trusted platform",
"scope": "eq",
"trust": 1.6,
"vendor": "infineon",
"version": "4.32"
},
{
"model": "rsa library",
"scope": "eq",
"trust": 1.2,
"vendor": "infineon",
"version": "1.02.013"
},
{
"model": "rsa library",
"scope": "lte",
"trust": 1.0,
"vendor": "infineon",
"version": "1.02.013"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "atos se",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "dell",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gemalto av",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "google",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "hewlett packard",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "infineon",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "lenovo",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "rubrik",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "taglio",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "winmagic",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "yubico",
"version": null
},
{
"model": "rsa library",
"scope": "eq",
"trust": 0.8,
"vendor": "infineon",
"version": "version 1.02.013"
},
{
"model": "yubikey 4c",
"scope": "eq",
"trust": 0.3,
"vendor": "yubico",
"version": "4.3.4"
},
{
"model": "yubikey 4c",
"scope": "eq",
"trust": 0.3,
"vendor": "yubico",
"version": "4.2.6"
},
{
"model": "yubikey nano",
"scope": "eq",
"trust": 0.3,
"vendor": "yubico",
"version": "44.3.4"
},
{
"model": "yubikey nano",
"scope": "eq",
"trust": 0.3,
"vendor": "yubico",
"version": "44.2.6"
},
{
"model": "yubikey",
"scope": "eq",
"trust": 0.3,
"vendor": "yubico",
"version": "44.3.4"
},
{
"model": "yubikey",
"scope": "eq",
"trust": 0.3,
"vendor": "yubico",
"version": "44.2.6"
},
{
"model": "thinkpad yoga s1",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "2600"
},
{
"model": "thinkpad yoga s3",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "144600"
},
{
"model": "thinkpad yoga 11e",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "x2600"
},
{
"model": "thinkpad tablet",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "x10"
},
{
"model": "thinkpad carbon",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "x10"
},
{
"model": "thinkpad t560",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad t470p",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad t460s",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad p70",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad p51",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad p50s",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad p50",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad l570",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad l560",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad l470",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad l460",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad e565",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad e560",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad e465",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad e460",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "thinkpad 11e",
"scope": "eq",
"trust": 0.3,
"vendor": "lenovo",
"version": "0"
},
{
"model": "rsa library",
"scope": "eq",
"trust": 0.3,
"vendor": "infineon",
"version": "1.2.13"
},
{
"model": "trusted platform module option kit",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "2.0"
},
{
"model": "slb (tpm",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "96702.0)0"
},
{
"model": "slb (tpm",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "96701.2)0"
},
{
"model": "slb (tpm",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "96652.0)0"
},
{
"model": "slb (tpm",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "96601.2)0"
},
{
"model": "mobile workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "0"
},
{
"model": "mobile thin client and tablet",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "0"
},
{
"model": "commercial notebook pc",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "0"
},
{
"model": "chrome os m63",
"scope": null,
"trust": 0.3,
"vendor": "google",
"version": null
},
{
"model": "chrome os m62",
"scope": null,
"trust": 0.3,
"vendor": "google",
"version": null
},
{
"model": "chrome os m61",
"scope": null,
"trust": 0.3,
"vendor": "google",
"version": null
},
{
"model": "idprime.net",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "tpm 2.0 fw7.61",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 2.0 fw7.00",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 2.0 fw5.61",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 2.0 fw5.00",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw6.42",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw6.00",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw4.42",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw4.40",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw4.33",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw4.00",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw149.32",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "tpm 1.2 fw133.32",
"scope": null,
"trust": 0.3,
"vendor": "fujitsu",
"version": null
},
{
"model": "chrome os m80",
"scope": "ne",
"trust": 0.3,
"vendor": "google",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "trusted platform",
"version": "4.31"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "trusted platform",
"version": "4.32"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "trusted platform",
"version": "6.40"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "trusted platform",
"version": "133.32"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "rsa library",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"db": "CERT/CC",
"id": "VU#307015"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "BID",
"id": "101484"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:infineon:trusted_platform_firmware:6.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:infineon:trusted_platform_firmware:133.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:infineon:trusted_platform_firmware:4.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:infineon:trusted_platform_firmware:4.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:viglen:chromebook_11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:viglen:chromebook_360:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:toshiba:chromebook_2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:senkatel:c1101_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:rgs:education_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:prowise:proline_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:ncomputing:chromebook_cx100:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:medion:chromebook_s2015:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:n20_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:n21_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:thinkpad_11e_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:thinkpad_13_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_g4\\/g4_ee:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_g1:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_14_ak000-099:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_14_g4:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:haier:chromebook_11_g2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:haier:chromebook_11e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:edugear:chromebook_m:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:edugear:chromebook_r:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:dell:chromebox:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:bobicus:chromebook_11:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_flip_c100pa:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_flip_c302:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:aopen:chromeboxi:-:*:mini:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:c720_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_11_c771:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_11_c771t:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_11_n7_c731:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_r11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_r13_cb5-312t:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:ctl:nl61_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:ctl:n6_chromebook:-:*:*:*:*:education:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:videonet:chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:videonet:chromebook_bl10:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:sector-five:e1_rugged_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:samsung:chromebook_2_11_xe500c12:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:prowise:entry_line_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:positivo:chromebook_ch1190:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:medion:akoya_s2013:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:mercer:chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:n22_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:n23_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook:-:*:*:*:*:meetings:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_1100-1199:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_g2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_g5:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_14_x000-x999:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_14_g3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:haier:chromebook_11_c:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:google:pixel:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:edugear:cmt_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:dell:chromebook_11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebit_cs10:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_c200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_c201pa:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebox_cn60:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebox_cn62:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebase:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebase_24:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_13_cb5-311:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_14_cb3-431:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebox:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebox_cxi2:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:ctl:j5_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:ctl:j4_chromebook:-:*:*:*:*:education:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:true:idc_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:true:idc_chromebook_11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:samsung:chromebook_2_11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:samsung:chromebook_2_13:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:poin2:chromebook_11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:poin2:chromebook_14:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:mercer:v2_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lg:chromebase_22cb25s:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:n23_yoga_11_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_2000-2099:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_2100-2199:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11-vxxx:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_g5_ee:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebox_cb1-\\(000-099\\):-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebox_g1:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hisense:chromebook_11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:epik:chromebook_elb1101:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:edxis:chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:dell:chromebook_11_3120:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:dell:chromebook_11_3189:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_c202sa:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_c300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asi:chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:aopen:chromebase:-:*:commercial:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_11_c730:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_11_c730e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_14_for_work_cp5-471:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_15_cb3-531:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:ctl:j2_chromebook:-:*:*:*:*:education:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:xolo:chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:toshiba:chromebook_2:-:*:2015:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:toshiba:chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:samsung:chromebook_3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:samsung:chromebook_plus:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:samsung:chromebook_pro:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:pcmerge:chromebook_pcm-116t-432b:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:nexian:chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lg:chromebase_22cv241:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:100s_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:n23_flex_11_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:n42_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:lenovo:thinkcentre_chromebox:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_g3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_11_2200-2299:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_13_g1:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hp:chromebook_14:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:hexa:chromebook_pi:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:haier:chromebook_11:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:edxis:education_chromebook:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:edugear:chromebook_k:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:dell:chromebook_11_model_3180:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:dell:chromebook_13_3380:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_c300sa:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:asus:chromebook_c301sa:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:aopen:chromebox:-:*:commercial:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:aopen:chromebase:-:*:mini:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_11_c735:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_11_c740:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_15_cb3-532:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:acer:chromebook_15_cb5-571:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:infineon:rsa_library:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.02.013",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-15361"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec, and Vashek Matyas.",
"sources": [
{
"db": "BID",
"id": "101484"
}
],
"trust": 0.3
},
"cve": "CVE-2017-15361",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 8.8,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "COMPLETE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 6.9,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 8.6,
"id": "CVE-2017-15361",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "OFFICIAL FIX",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:M/Au:N/C:C/I:C/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 8.8,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2017-008423",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-33657",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-106176",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-15361",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 7.4,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2017-008423",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-15361",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-15361",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2017-008423",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2017-33657",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201710-558",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-106176",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-15361",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"db": "CERT/CC",
"id": "VU#307015"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "VULHUB",
"id": "VHN-106176"
},
{
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS. This vulnerability is often cited as \"ROCA\" in the media. Infineon Made RSA The library contains RSA There is a problem that does not generate the key pair properly. As a result, generated using this library RSA The private key corresponding to the public key may be obtained. Cryptographic issues (CWE-310) - CVE-2017-15361 Infineon Made RSA The library contains RSA There is a problem that does not generate the key pair properly. Using the library RSA When generating a key pair, a more efficient search method than the exhaustive key search can be applied. at least 2048 There is a possibility of obtaining a secret key with a key length of less than or equal to bits. This attack was generated by the library RSA It can be applied simply by obtaining a public key. In addition, this case RSA Problem with key generation ECC ( Elliptic curve cryptography ) Is not affected. Also generated by other devices and libraries RSA key Can also be used safely with this library. The library is Trusted Platform Modules (TPM) Or a smart card. Information on affected vendors is available on the developer\u0027s site. For details, refer to the information published by the discoverer. Developer site https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160 Information published by the discoverer https://crocs.fi.muni.cz/public/papers/rsa_ccs17Using the library RSA If a key is generated, there is a possibility that a private key may be obtained by a remote third party. An attacker could exploit this vulnerability to compromise the encryption protection mechanism. \nAttackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03789en_us\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: hpesbhf03789en_us\nVersion: 2\n\nHPESBHF03789 rev.2 - Certain HPE Gen9 Systems with HP Trusted Platform Module\nv2.0 Option, Unauthorized Access to Data\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2017-10-18\nLast Updated: 2017-10-17\n\nPotential Security Impact: Local: Unauthorized Access to Data; Remote:\nUnauthorized Access to Data\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nA potential security vulnerability has been identified in the \"HP Trusted\nPlatform Module 2.0 Option\" kit. This optional kit is available for HPE Gen9\nsystems with firmware version 5.51. The vulnerability in TPM firmware 5.51 is\nthat new mathematical methods exist such that RSA keys generated by the TPM\n2.0 with firmware 5.51 are cryptographically weakened. This vulnerability\ncould lead to local and remote unauthorized access to data. \n\nReferences:\n\n - PSRT110605\n - PSRT110598\n - CVE-2017-15361\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. This is the Gen9 TPM 2.0 option (only Gen9 servers could have this\noption). The TPM 2.0 Option for Gen9 servers is not standard on Gen9 servers\n- - it is an option. \n - HP ProLiant BL460c Gen9 Server Blade n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant BL660c Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL120 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL160 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL360 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL380 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL388 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL580 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL60 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant DL80 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant ML110 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HP ProLiant ML150 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE Apollo 4200 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant DL180 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant DL180 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant DL20 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant DL560 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant ML10 Gen9 E3-1225 v5 3.3GHz 4-core 8GB-R 1TB Non-hot Plug\n4LFF SATA 300W AP Svr/Promo n/a - only if \"HPE Trusted Platform Module 2.0\nKit\" w/ FW version 5.51 is installed. \n - HPE ProLiant ML10 Gen9 E3-1225 v5 4GB-R 1TB Non-hot Plug 4LFF SATA 300W\nSvr/S-Buy n/a - only if \"HPE Trusted Platform Module 2.0 Kit\" w/ FW version\n5.51 is installed. \n - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 1TB Non-hot Plug 4LFF SATA 300W\nPerf Svr n/a - only if \"HPE Trusted Platform Module 2.0 Kit\" w/ FW version\n5.51 is installed. \n - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 2TB Non-hot Plug 4LFF SATA 300W\nSvr/GO n/a - only if \"HPE Trusted Platform Module 2.0 Kit\" w/ FW version 5.51\nis installed. \n - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 2TB Non-hot Plug 4LFF SATA 300W\nSvr/TV n/a - only if \"HPE Trusted Platform Module 2.0 Kit\" w/ FW version 5.51\nis installed. \n - HPE ProLiant ML10 Gen9 G4400 4GB-R Non-hot Plug 4LFF SATA 300W Entry Svr\nn/a - only if \"HPE Trusted Platform Module 2.0 Kit\" w/ FW version 5.51 is\ninstalled. \n - HPE ProLiant ML30 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant ML350 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant ML350 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL170r Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL190r Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL230a Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL230a Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL250a Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL250a Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL260a Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL450 Gen9 Server n/a - only if \"HPE Trusted Platform Module\n2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL730f Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL730f Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL740f Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL740f Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL750f Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n - HPE ProLiant XL750f Gen9 Server n/a - only if \"HPE Trusted Platform\nModule 2.0 Kit\" w/ FW version 5.51 is installed. \n\nBACKGROUND\n\n CVSS Base Metrics\n =================\n Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector\n\n CVE-2017-15361\n 7.4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)\n\n Information on CVSS is documented in\n HPE Customer Notice HPSN-2008-002 here:\n\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499\n\nRESOLUTION\n\nHPE has provided both an updated system ROM, and updated TPM firmware to\ncorrect this issue for impacted systems. Update the system ROM and \"HPE\nTrusted Platform Module 2.0 Option\" to firmware version 5.62 or subsequent. \n\nThe latest version of the System ROM is available, and must be updated before\nupdating the TPM firmware. Use these instructions:\n\n1.Click the following link: \n\n * \u003chttp://www.hpe.com/support/hpesc\u003e\n\n2.Enter a product name (e.g., \"DL380 Gen9\") in the text field under Enter a\nProduct Name or Number. \n3.Click Go. \n4.Select the appropriate product model from the Results list (if prompted). \n5.Click the \"drivers, software \u0026 firmware\" hyperlink under the Download\nOptions tab. \n6.Select the system\u0027s specific operating system from the Operating Systems\ndropdown menu. \n7.Click the category BIOS - System ROM. \n8.Select the latest release of HPE System ROM Version 2.50 (or later). \n9.Click Download. \n\n\nThe latest version of the TPM firmware is available. Use these instructions:\n\n 1.Click the following link:\n\n * \u003chttp://www.hpe.com/support/hpesc\u003e\n\n 2.Enter a product name (e.g., \"DL380 Gen9\") in the text field under Enter a\nProduct Name or Number. \n 3.Click Go. \n 4.Select the appropriate product model from the Results list (if prompted). \n\n 5.Click the \"drivers, software \u0026 firmware\" hyperlink under the Download\nOptions tab. \n 6.Select the system\u0027s specific operating system from the Operating Systems\ndropdown menu. \n 7.Click the category Firmware. \n 8.Select the latest release of the HPE Trusted Platform Module 2.0 Option\nfirmware update for HPE Gen9 Severs Version 5.62 (or later). \n 9.Click Download. \n\n**Note:** \n\n * After the firmware upgrade, the TPM will generate RSA keys using an\nimproved algorithm. Revoking the weak TPM generated RSA keys will still be\nrequired. Refer to the OS documentation for OS-specific instructions. In\naddition, a System ROM update to version 2.50 (or later) is required before\nupdating the TPM 2.0 firmware. \n \n * Please refer to the HPE *Customer Bulletin* as well:\n \n - **HPE ProLiant Gen9 Servers** - Potential Vulnerability in the HPE\nTrusted Platform Module 2.0 Option Firmware Version 5.51 for HPE ProLiant\nGen9 Servers\n\u003chttp://h20565.www2.hpe.com/hpsc/doc/public/display?docId=a00028289en_us\u003e\n\nHISTORY\n\nVersion:1 (rev.1) - 16 October 2017 Initial release\n\nVersion:2 (rev.2) - 17 October 2017 Added CVE reference\n\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability for any HPE supported\nproduct:\n Web form: https://www.hpe.com/info/report-security-vulnerability\n Email: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAEBCAAGBQJZ5k72AAoJELXhAxt7SZaiU4EIAKJK3i30Qui8Fqm7/Kr5R/oB\nUgW8kg/4EkbEpJ7ewQwjE2gaIMUmo6q2we+mpLU3/4T8+ZcZgxw7hDZqOrOn7V08\nrzchXK1oLqdW9vu0BlWrUK6TTWHghW38nwqLHhmxuRavrVR4kYB+ctfFUS3vaSVd\neQWBn6coSrkeToazgtvlPilChl1ygH4NITmLBXPnSbcp8U1yLhF+j0eUKLcZnR8l\nOMi65CVCNWCcSL3NV6x4NXvREmehKXGqgokGUe6rBWucU+A21W66GhsnhC5ysa4j\nSR8Ungf0W1QihfW3+Jijiu5hC7mrcZrGi+AZAvJDb4S5zvfM+hVUZNuEGa6nzVM=\n=KoaT\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"db": "CERT/CC",
"id": "VU#307015"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "BID",
"id": "101484"
},
{
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"db": "VULHUB",
"id": "VHN-106176"
},
{
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"db": "PACKETSTORM",
"id": "144646"
}
],
"trust": 3.6
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-15361",
"trust": 4.6
},
{
"db": "CERT/CC",
"id": "VU#307015",
"trust": 3.7
},
{
"db": "BID",
"id": "101484",
"trust": 2.7
},
{
"db": "LENOVO",
"id": "LEN-15552",
"trust": 2.1
},
{
"db": "SIEMENS",
"id": "SSA-470231",
"trust": 1.8
},
{
"db": "ICS CERT",
"id": "ICSA-18-058-01",
"trust": 1.8
},
{
"db": "CNNVD",
"id": "CNNVD-201710-558",
"trust": 0.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-058-01A",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-33657",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU95530052",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423",
"trust": 0.8
},
{
"db": "IVD",
"id": "0E0DF457-AAB1-4879-A7C8-5371086A00D5",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "144646",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-99005",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-106176",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-15361",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"db": "CERT/CC",
"id": "VU#307015"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "VULHUB",
"id": "VHN-106176"
},
{
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"db": "BID",
"id": "101484"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "PACKETSTORM",
"id": "144646"
},
{
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"id": "VAR-201710-0668",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "VULHUB",
"id": "VHN-106176"
}
],
"trust": 1.4398148266666666
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
}
]
},
"last_update_date": "2023-12-18T13:48:29.328000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Information on TPM firmware update for Microsoft Windows systems as announced on Microsoft`s patchday on October 10th 2017",
"trust": 0.8,
"url": "https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirid=59160"
},
{
"title": "Security Alert 20171012",
"trust": 0.8,
"url": "http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2017/securityalert20171012.html"
},
{
"title": "Infineon RSA Library Encryption Security Bypass Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/105950"
},
{
"title": "Infineon Trusted Platform Module Infineon RSA Repair measures for library security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=75565"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2017/10/23/roca_crypto_flaw_gemalto/"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2017/10/16/roca_crypto_vuln_infineon_chips/"
},
{
"title": "HP: SUPPORT COMMUNICATION- SECURITY BULLETIN\nHPSBPI03583 rev. 1 - ROCA - Vulnerable RSA Generation: HP Trusted Platform Module (TPM) Accessory and Certain HP Enterprise Printer and MFP Products, Certain HP PageWide Printer and MFP Products with Standard TPM",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hp_bulletin\u0026qid=d442339efd5a6d4834ac93a8dc07c35d"
},
{
"title": "HP: HPSBHF03568 rev. 11 - Infineon TPM Security Update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hp_bulletin\u0026qid=hpsbhf03568"
},
{
"title": "HP: SUPPORT COMMUNICATION- SECURITY BULLETIN\nHPSBHF03568 rev. 11 - Infineon TPM Security Update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hp_bulletin\u0026qid=ca9eba9c5c56724cf0dd05e2bbff5dc4"
},
{
"title": "HP: HPSBPI03583 rev. 1 - ROCA - Vulnerable RSA Generation: HP Trusted Platform Module (TPM) Accessory and Certain HP Enterprise Printer and MFP Products, Certain HP PageWide Printer and MFP Products with Standard TPM",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hp_bulletin\u0026qid=hpsbpi03583"
},
{
"title": "HP: SUPPORT COMMUNICATION- SECURITY BULLETIN\nHPSBHF03568 rev. 11 - Infineon TPM Security Update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hp_bulletin\u0026qid=03aca358debd7682b3b457bbf62087d3"
},
{
"title": "Infineon-CVE-2017-15361",
"trust": 0.1,
"url": "https://github.com/lva/infineon-cve-2017-15361 "
},
{
"title": "RocaCmTest",
"trust": 0.1,
"url": "https://github.com/jnpuskar/rocacmtest "
},
{
"title": "zeek-plugin-roca",
"trust": 0.1,
"url": "https://github.com/0xxon/bro-plugin-roca "
},
{
"title": "Detect-CVE-2017-15361-TPM",
"trust": 0.1,
"url": "https://github.com/nsacyber/detect-cve-2017-15361-tpm "
},
{
"title": "cedarkey",
"trust": 0.1,
"url": "https://github.com/nuclearcat/cedarkey "
},
{
"title": "roca",
"trust": 0.1,
"url": "https://github.com/brunoproduit/roca "
},
{
"title": "zeek-plugin-roca",
"trust": 0.1,
"url": "https://github.com/0xxon/zeek-plugin-roca "
},
{
"title": "tpm-firmware",
"trust": 0.1,
"url": "https://github.com/fishilico/tpm-firmware "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/google/paranoid_crypto "
},
{
"title": "Exp101tsArchiv30thers",
"trust": 0.1,
"url": "https://github.com/nu11secur1ty/exp101tsarchiv30thers "
},
{
"title": "awesome-cve-poc_qazbnm456",
"trust": 0.1,
"url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
},
{
"title": "BleepingComputer",
"trust": 0.1,
"url": "https://www.bleepingcomputer.com/news/security/microsoft-warns-of-windows-hello-for-business-orphaned-key-risks/"
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/factorization-flaw-in-tpm-chips-makes-attacks-on-rsa-private-keys-feasible/128474/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-310",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-106176"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "NVD",
"id": "CVE-2017-15361"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://crocs.fi.muni.cz/public/papers/rsa_ccs17"
},
{
"trust": 3.4,
"url": "https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirid=59160"
},
{
"trust": 3.0,
"url": "https://www.kb.cert.org/vuls/id/307015"
},
{
"trust": 2.9,
"url": "http://support.lenovo.com/us/en/product_security/len-15552"
},
{
"trust": 2.9,
"url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv170012"
},
{
"trust": 2.6,
"url": "https://github.com/crocs-muni/roca"
},
{
"trust": 2.6,
"url": "https://blog.cr.yp.to/20171105-infineon.html"
},
{
"trust": 2.6,
"url": "https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/101484"
},
{
"trust": 1.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf"
},
{
"trust": 1.8,
"url": "https://security.netapp.com/advisory/ntap-20171024-0001/"
},
{
"trust": 1.8,
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00104.html"
},
{
"trust": 1.8,
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html"
},
{
"trust": 1.8,
"url": "https://www.yubico.com/support/security-advisories/ysa-2017-01/"
},
{
"trust": 1.8,
"url": "https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/"
},
{
"trust": 1.8,
"url": "https://dan.enigmabridge.com/roca-vulnerability-impact-on-gemalto-idprime-net-smart-cards/"
},
{
"trust": 1.8,
"url": "https://github.com/iadgov/detect-cve-2017-15361-tpm"
},
{
"trust": 1.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-058-01"
},
{
"trust": 1.8,
"url": "https://keychest.net/roca"
},
{
"trust": 1.8,
"url": "https://monitor.certipath.com/rsatest"
},
{
"trust": 1.7,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03801en_us"
},
{
"trust": 1.7,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03789en_us"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-15361"
},
{
"trust": 0.9,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-hpesbhf03789en_us"
},
{
"trust": 0.8,
"url": "https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf"
},
{
"trust": 0.8,
"url": "http://cwe.mitre.org/data/definitions/310.html"
},
{
"trust": 0.8,
"url": "http://www.dell.com/support/article/us/en/19/sln307820/"
},
{
"trust": 0.8,
"url": "http://www.fujitsu.com/global/support/products/software/security/products-f/ifsa-201701e.html"
},
{
"trust": 0.8,
"url": "https://safenet.gemalto.com/technical-support/security-updates/"
},
{
"trust": 0.8,
"url": "https://support.rubrik.com/articles/how_to/000001116"
},
{
"trust": 0.8,
"url": "https://www.yubico.com/keycheck/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-15361"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-058-01a"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95530052/"
},
{
"trust": 0.3,
"url": "https://www.infineon.com/"
},
{
"trust": 0.3,
"url": "https://support.hp.com/us-en/document/c05792935"
},
{
"trust": 0.1,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-hpesbhf03789en_us"
},
{
"trust": 0.1,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-hpesbhf03801en_us"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://github.com/lva/infineon-cve-2017-15361"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-058-01a"
},
{
"trust": 0.1,
"url": "http://h20565.www2.hpe.com/hpsc/doc/public/display?docid=a00028289en_us\u003e"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/security_bulletin_archive"
},
{
"trust": 0.1,
"url": "https://www.hpe.com/info/report-security-vulnerability"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/subscriber_choice"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/hpesc\u003e"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#307015"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "VULHUB",
"id": "VHN-106176"
},
{
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"db": "BID",
"id": "101484"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "PACKETSTORM",
"id": "144646"
},
{
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"db": "CERT/CC",
"id": "VU#307015"
},
{
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"db": "VULHUB",
"id": "VHN-106176"
},
{
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"db": "BID",
"id": "101484"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"db": "PACKETSTORM",
"id": "144646"
},
{
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-11-13T00:00:00",
"db": "IVD",
"id": "0e0df457-aab1-4879-a7c8-5371086a00d5"
},
{
"date": "2017-10-16T00:00:00",
"db": "CERT/CC",
"id": "VU#307015"
},
{
"date": "2017-11-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"date": "2017-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-106176"
},
{
"date": "2017-10-16T00:00:00",
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"date": "2017-10-16T00:00:00",
"db": "BID",
"id": "101484"
},
{
"date": "2017-10-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"date": "2017-10-17T15:22:22",
"db": "PACKETSTORM",
"id": "144646"
},
{
"date": "2017-10-16T17:29:00.243000",
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"date": "2017-10-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#307015"
},
{
"date": "2017-11-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-33657"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-106176"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-15361"
},
{
"date": "2017-10-23T20:04:00",
"db": "BID",
"id": "101484"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008423"
},
{
"date": "2019-10-03T00:03:26.223000",
"db": "NVD",
"id": "CVE-2017-15361"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Infineon RSA library does not properly generate RSA key pairs",
"sources": [
{
"db": "CERT/CC",
"id": "VU#307015"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201710-558"
}
],
"trust": 0.6
}
}
VAR-201710-1106
Vulnerability from variot - Updated: 2023-12-18 12:03Remote enabling and disabling admin interface in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to new attack vectors. Gemalto Sentinel License Manager is prone to the following security vulnerabilities: 1. Multiple stack-based buffer-overflow vulnerabilities. 2. Multiple heap-based buffer-overflow vulnerabilities. 3. A security bypass vulnerability. 4. A denial-of-service vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Sentinel LDK is a license management tool. A remote attacker could exploit this vulnerability to execute code
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-1106",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ldk rte",
"scope": "lte",
"trust": 1.0,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk rte",
"scope": "lt",
"trust": 0.8,
"vendor": "gemalto n v",
"version": "7.55"
},
{
"model": "ldk rte",
"scope": "eq",
"trust": 0.6,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.54"
},
{
"model": "sentinel hasp",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "hasp srm",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "sentinel ldk",
"scope": "ne",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.55"
}
],
"sources": [
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sentinel:sentinel_ldk_rte_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.50",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12822"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky Labs",
"sources": [
{
"db": "BID",
"id": "102906"
}
],
"trust": 0.3
},
"cve": "CVE-2017-12822",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-12822",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-103383",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.3,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "Low",
"baseScore": 9.9,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-12822",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12822",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-201708-493",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-103383",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-12822",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103383"
},
{
"db": "VULMON",
"id": "CVE-2017-12822"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Remote enabling and disabling admin interface in Gemalto\u0027s HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to new attack vectors. Gemalto Sentinel License Manager is prone to the following security vulnerabilities:\n1. Multiple stack-based buffer-overflow vulnerabilities. \n2. Multiple heap-based buffer-overflow vulnerabilities. \n3. A security bypass vulnerability. \n4. A denial-of-service vulnerability. \nAttackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Sentinel LDK is a license management tool. A remote attacker could exploit this vulnerability to execute code",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "VULHUB",
"id": "VHN-103383"
},
{
"db": "VULMON",
"id": "CVE-2017-12822"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12822",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-093-01",
"trust": 2.6
},
{
"db": "BID",
"id": "102906",
"trust": 2.1
},
{
"db": "SIEMENS",
"id": "SSA-727467",
"trust": 1.8
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-03",
"trust": 1.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-018-01",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201708-493",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-103383",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-12822",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103383"
},
{
"db": "VULMON",
"id": "CVE-2017-12822"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"id": "VAR-201710-1106",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-103383"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:03:11.887000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://sentinelcustomer.gemalto.com/"
},
{
"title": "Gemalto HASP SRM , Sentinel HASP and Sentinel LDK Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99966"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.1
},
{
"problemtype": "CWE-284",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103383"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "NVD",
"id": "CVE-2017-12822"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-008-sentinel-ldk-rte-remote-enabling-and-disabling-admin-interface/"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/102906"
},
{
"trust": 1.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf"
},
{
"trust": 1.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-093-01"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-03"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12822"
},
{
"trust": 0.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-018-01"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-093-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12822"
},
{
"trust": 0.3,
"url": "https://sentinelcustomer.gemalto.com"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/306.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103383"
},
{
"db": "VULMON",
"id": "CVE-2017-12822"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-103383"
},
{
"db": "VULMON",
"id": "CVE-2017-12822"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-04T00:00:00",
"db": "VULHUB",
"id": "VHN-103383"
},
{
"date": "2017-10-04T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12822"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2017-11-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"date": "2017-10-04T01:29:02.277000",
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"date": "2017-08-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-103383"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12822"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009454"
},
{
"date": "2019-10-03T00:03:26.223000",
"db": "NVD",
"id": "CVE-2017-12822"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Gemalto Product Sentinel LDK RTE Firmware access control vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009454"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "access control error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-493"
}
],
"trust": 0.6
}
}
VAR-201710-1105
Vulnerability from variot - Updated: 2023-12-18 12:03Memory corruption in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 might cause remote code execution. Gemalto Sentinel License Manager is prone to the following security vulnerabilities: 1. Multiple stack-based buffer-overflow vulnerabilities. 2. Multiple heap-based buffer-overflow vulnerabilities. 3. A security bypass vulnerability. 4. A denial-of-service vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Sentinel LDK is a license management tool
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-1105",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ldk rte",
"scope": "lte",
"trust": 1.0,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk rte",
"scope": "lt",
"trust": 0.8,
"vendor": "gemalto n v",
"version": "7.55"
},
{
"model": "ldk rte",
"scope": "eq",
"trust": 0.6,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.54"
},
{
"model": "sentinel hasp",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "hasp srm",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "sentinel ldk",
"scope": "ne",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.55"
}
],
"sources": [
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sentinel:sentinel_ldk_rte_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.50",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12821"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky Labs",
"sources": [
{
"db": "BID",
"id": "102906"
}
],
"trust": 0.3
},
"cve": "CVE-2017-12821",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-12821",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-103382",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-12821",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12821",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-201708-494",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-103382",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-12821",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103382"
},
{
"db": "VULMON",
"id": "CVE-2017-12821"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Memory corruption in Gemalto\u0027s HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 might cause remote code execution. Gemalto Sentinel License Manager is prone to the following security vulnerabilities:\n1. Multiple stack-based buffer-overflow vulnerabilities. \n2. Multiple heap-based buffer-overflow vulnerabilities. \n3. A security bypass vulnerability. \n4. A denial-of-service vulnerability. \nAttackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Sentinel LDK is a license management tool",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "VULHUB",
"id": "VHN-103382"
},
{
"db": "VULMON",
"id": "CVE-2017-12821"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12821",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-093-01",
"trust": 2.0
},
{
"db": "BID",
"id": "102906",
"trust": 1.5
},
{
"db": "SIEMENS",
"id": "SSA-727467",
"trust": 1.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-03",
"trust": 1.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-018-01",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201708-494",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-103382",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-12821",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103382"
},
{
"db": "VULMON",
"id": "CVE-2017-12821"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
]
},
"id": "VAR-201710-1105",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-103382"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:03:11.854000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://sentinelcustomer.gemalto.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103382"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"db": "NVD",
"id": "CVE-2017-12821"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-007-sentinel-ldk-rte-memory-corruption-might-cause-remote-code-execution/"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/102906"
},
{
"trust": 1.2,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-093-01"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-03"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12821"
},
{
"trust": 0.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-018-01"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-093-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12821"
},
{
"trust": 0.3,
"url": "https://sentinelcustomer.gemalto.com"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103382"
},
{
"db": "VULMON",
"id": "CVE-2017-12821"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-103382"
},
{
"db": "VULMON",
"id": "CVE-2017-12821"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-04T00:00:00",
"db": "VULHUB",
"id": "VHN-103382"
},
{
"date": "2017-10-04T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12821"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2017-11-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"date": "2017-10-04T01:29:02.247000",
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"date": "2017-08-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-11T00:00:00",
"db": "VULHUB",
"id": "VHN-103382"
},
{
"date": "2018-05-11T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12821"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009453"
},
{
"date": "2018-05-11T01:29:01.733000",
"db": "NVD",
"id": "CVE-2017-12821"
},
{
"date": "2017-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Gemalto Product Sentinel LDK RTE Firmware buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009453"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-494"
}
],
"trust": 0.6
}
}
VAR-201710-0970
Vulnerability from variot - Updated: 2023-12-18 12:03Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters. Sentinel LDK Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SIMATIC WinCC is an automated data acquisition and monitoring control (SCADA) system. Gemalto Sentinel LDK RTE is a software protection and licensing solution. Gemalto Sentinel License Manager is prone to the following security vulnerabilities: 1. Multiple stack-based buffer-overflow vulnerabilities. 2. Multiple heap-based buffer-overflow vulnerabilities. 3. A security bypass vulnerability. 4. A denial-of-service vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. The following Sentinel License Manger services are affected: Gemalto HASP SRM Gemalto Sentinel HASP Gemalto Sentinel LDK products prior to Sentinel LDK RTE 7.55
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0970",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "2.10"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "7.50"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "7.1"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "3.0"
},
{
"model": "sentinel ldk",
"scope": null,
"trust": 0.8,
"vendor": "gemalto n v",
"version": null
},
{
"model": "simatic wincc add-on historian connect alarm",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v5.x"
},
{
"model": "simatic wincc add-on pi connect alarm",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v2.x"
},
{
"model": "simatic wincc add-on pi connect audit trail",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v1.x"
},
{
"model": "simatic wincc add-on pm-agent",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v5.x"
},
{
"model": "simatic wincc add-on pm-analyze",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-control",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v10.x"
},
{
"model": "simatic wincc add-on pm-maint",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v9.x"
},
{
"model": "simatic wincc add-on pm-open export",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open host-s",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open import",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v6.x"
},
{
"model": "simatic wincc add-on pm-open pi",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open pv02",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v1.x"
},
{
"model": "simatic wincc add-on pm-open tcp/ip",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v8.x"
},
{
"model": "simatic wincc add-on pm-quality",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v9.x"
},
{
"model": "simatic wincc add-on sicement it mis",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on sipaper it mis",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on sipaper it mis",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on sicement it mis and",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-quality",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "simatic wincc add-on pm-open tcp/ip",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.0"
},
{
"model": "simatic wincc add-on pm-open pv02",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1.0"
},
{
"model": "simatic wincc add-on pm-open pi",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-open import",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "6.0"
},
{
"model": "simatic wincc add-on pm-open host-s",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-open export",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-maint",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "simatic wincc add-on pm-control",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "10.0"
},
{
"model": "simatic wincc add-on pm-analyze",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-agent",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "simatic wincc add-on pi connect audit trail",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1.0"
},
{
"model": "simatic wincc add-on pi connect alarm",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "2.0"
},
{
"model": "simatic wincc add-on historian connect alarm",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "sentinel ldk",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.54"
},
{
"model": "sentinel hasp",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "hasp srm",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "sentinel ldk",
"scope": "ne",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.55"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "2.10"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "3.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "7.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "7.50"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:7.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11497"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sergey Temnikov and Vladimir Dashchenko from Kaspersky Lab",
"sources": [
{
"db": "BID",
"id": "102739"
}
],
"trust": 0.3
},
"cve": "CVE-2017-11497",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-11497",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-01326",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "e2e26730-39ab-11e9-8251-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-11497",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-11497",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2018-01326",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-925",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-11497",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"db": "VULMON",
"id": "CVE-2017-11497"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters. Sentinel LDK Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SIMATIC WinCC is an automated data acquisition and monitoring control (SCADA) system. Gemalto Sentinel LDK RTE is a software protection and licensing solution. Gemalto Sentinel License Manager is prone to the following security vulnerabilities:\n1. Multiple stack-based buffer-overflow vulnerabilities. \n2. Multiple heap-based buffer-overflow vulnerabilities. \n3. A security bypass vulnerability. \n4. A denial-of-service vulnerability. \nAttackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. \nThe following Sentinel License Manger services are affected:\nGemalto HASP SRM\nGemalto Sentinel HASP\nGemalto Sentinel LDK products prior to Sentinel LDK RTE 7.55",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "VULMON",
"id": "CVE-2017-11497"
}
],
"trust": 2.97
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-11497",
"trust": 3.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-018-01",
"trust": 2.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-093-01",
"trust": 1.9
},
{
"db": "BID",
"id": "102906",
"trust": 1.4
},
{
"db": "BID",
"id": "102739",
"trust": 1.4
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-03",
"trust": 1.2
},
{
"db": "SIEMENS",
"id": "SSA-727467",
"trust": 1.1
},
{
"db": "SIEMENS",
"id": "SSA-127490",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2018-01326",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-925",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E26730-39AB-11E9-8251-000C29342CB1",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2017-11497",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"db": "VULMON",
"id": "CVE-2017-11497"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
]
},
"id": "VAR-201710-0970",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
}
],
"trust": 1.664732141875
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
}
]
},
"last_update_date": "2023-12-18T12:03:11.812000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Sentinel LDK",
"trust": 0.8,
"url": "https://sentinel.gemalto.com/software-monetization/sentinel-ldk/"
},
{
"title": "SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE component buffer overflow vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/113847"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"db": "NVD",
"id": "CVE-2017-11497"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-002-sentinel-ldk-rte-language-packs-containing-malformed-filenames-lead-to-remote-code-execution/"
},
{
"trust": 2.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-018-01"
},
{
"trust": 1.7,
"url": "https://www.iotvillage.org/slides_dc25/sergey_vlad_defcon_iot_village_public2017.pptx"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/102739"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-03"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/102906"
},
{
"trust": 1.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-093-01"
},
{
"trust": 1.1,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf"
},
{
"trust": 0.9,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-127490.pdf"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11497"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-093-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11497"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
},
{
"trust": 0.3,
"url": "https://sentinelcustomer.gemalto.com"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"db": "VULMON",
"id": "CVE-2017-11497"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"db": "VULMON",
"id": "CVE-2017-11497"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-19T00:00:00",
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"date": "2018-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"date": "2017-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11497"
},
{
"date": "2018-01-18T00:00:00",
"db": "BID",
"id": "102739"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2017-10-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"date": "2017-10-03T01:29:01.123000",
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"date": "2017-07-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-01326"
},
{
"date": "2018-05-11T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11497"
},
{
"date": "2018-01-18T00:00:00",
"db": "BID",
"id": "102739"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008951"
},
{
"date": "2018-05-11T01:29:01.030000",
"db": "NVD",
"id": "CVE-2017-11497"
},
{
"date": "2017-10-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE Component Buffer Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01326"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "e2e26730-39ab-11e9-8251-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-925"
}
],
"trust": 0.8
}
}
VAR-201710-1113
Vulnerability from variot - Updated: 2023-12-18 12:03Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service. Gemalto Sentinel License Manager is prone to the following security vulnerabilities: 1. Multiple stack-based buffer-overflow vulnerabilities. 2. Multiple heap-based buffer-overflow vulnerabilities. 3. A security bypass vulnerability. 4. A denial-of-service vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Gemalto Sentinel LDK RTE is a license management tool of American Gemalto (Gemalto). custom XML-parser is one of the XML parsers. A remote attacker could exploit this vulnerability to cause a denial of service
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-1113",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ldk rte",
"scope": "lte",
"trust": 1.0,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk rte",
"scope": "lt",
"trust": 0.8,
"vendor": "gemalto n v",
"version": "7.55"
},
{
"model": "ldk rte",
"scope": "eq",
"trust": 0.6,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.54"
},
{
"model": "sentinel hasp",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "hasp srm",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "sentinel ldk",
"scope": "ne",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.55"
}
],
"sources": [
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sentinel:sentinel_ldk_rte_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.50",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12818"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky Labs",
"sources": [
{
"db": "BID",
"id": "102906"
}
],
"trust": 0.3
},
"cve": "CVE-2017-12818",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-12818",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-103378",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-12818",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12818",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201710-423",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-103378",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-12818",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103378"
},
{
"db": "VULMON",
"id": "CVE-2017-12818"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack overflow in custom XML-parser in Gemalto\u0027s HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service. Gemalto Sentinel License Manager is prone to the following security vulnerabilities:\n1. Multiple stack-based buffer-overflow vulnerabilities. \n2. Multiple heap-based buffer-overflow vulnerabilities. \n3. A security bypass vulnerability. \n4. A denial-of-service vulnerability. \nAttackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Gemalto Sentinel LDK RTE is a license management tool of American Gemalto (Gemalto). custom XML-parser is one of the XML parsers. A remote attacker could exploit this vulnerability to cause a denial of service",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "VULHUB",
"id": "VHN-103378"
},
{
"db": "VULMON",
"id": "CVE-2017-12818"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12818",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-093-01",
"trust": 2.0
},
{
"db": "BID",
"id": "102906",
"trust": 1.5
},
{
"db": "SIEMENS",
"id": "SSA-727467",
"trust": 1.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-03",
"trust": 1.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-018-01",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201710-423",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-103378",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-12818",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103378"
},
{
"db": "VULMON",
"id": "CVE-2017-12818"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
]
},
"id": "VAR-201710-1113",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-103378"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:03:11.778000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://sentinelcustomer.gemalto.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103378"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"db": "NVD",
"id": "CVE-2017-12818"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-004-sentinel-ldk-rte-stack-overflow-in-custom-xml-parser-leads-to-remote-denial-of-service/"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/102906"
},
{
"trust": 1.2,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-093-01"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-03"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12818"
},
{
"trust": 0.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-018-01"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-093-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12818"
},
{
"trust": 0.3,
"url": "https://sentinelcustomer.gemalto.com"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103378"
},
{
"db": "VULMON",
"id": "CVE-2017-12818"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-103378"
},
{
"db": "VULMON",
"id": "CVE-2017-12818"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-04T00:00:00",
"db": "VULHUB",
"id": "VHN-103378"
},
{
"date": "2017-10-04T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12818"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2017-11-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"date": "2017-10-04T01:29:02.150000",
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"date": "2017-10-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-11T00:00:00",
"db": "VULHUB",
"id": "VHN-103378"
},
{
"date": "2018-05-11T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12818"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009450"
},
{
"date": "2018-05-11T01:29:01.547000",
"db": "NVD",
"id": "CVE-2017-12818"
},
{
"date": "2017-11-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Gemalto Product Sentinel LDK RTE Firmware buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009450"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201710-423"
}
],
"trust": 0.6
}
}
VAR-201710-0969
Vulnerability from variot - Updated: 2023-12-18 12:03Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via malformed ASN.1 streams in V2C and similar input files. Sentinel LDK Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SIMATIC WinCC is an automated data acquisition and monitoring control (SCADA) system. Gemalto Sentinel LDK RTE is a software protection and licensing solution. Gemalto Sentinel License Manager is prone to the following security vulnerabilities: 1. Multiple stack-based buffer-overflow vulnerabilities. 2. Multiple heap-based buffer-overflow vulnerabilities. 3. A security bypass vulnerability. 4. A denial-of-service vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. The following Sentinel License Manger services are affected: Gemalto HASP SRM Gemalto Sentinel HASP Gemalto Sentinel LDK products prior to Sentinel LDK RTE 7.55
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0969",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "2.10"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "7.50"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "7.1"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "3.0"
},
{
"model": "sentinel ldk",
"scope": null,
"trust": 0.8,
"vendor": "gemalto n v",
"version": null
},
{
"model": "simatic wincc add-on historian connect alarm",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v5.x"
},
{
"model": "simatic wincc add-on pi connect alarm",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v2.x"
},
{
"model": "simatic wincc add-on pi connect audit trail",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v1.x"
},
{
"model": "simatic wincc add-on pm-agent",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v5.x"
},
{
"model": "simatic wincc add-on pm-analyze",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-control",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v10.x"
},
{
"model": "simatic wincc add-on pm-maint",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v9.x"
},
{
"model": "simatic wincc add-on pm-open export",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open host-s",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open import",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v6.x"
},
{
"model": "simatic wincc add-on pm-open pi",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open pv02",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v1.x"
},
{
"model": "simatic wincc add-on pm-open tcp/ip",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v8.x"
},
{
"model": "simatic wincc add-on pm-quality",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v9.x"
},
{
"model": "simatic wincc add-on sicement it mis",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on sipaper it mis",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on sipaper it mis",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on sicement it mis and",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-quality",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "simatic wincc add-on pm-open tcp/ip",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.0"
},
{
"model": "simatic wincc add-on pm-open pv02",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1.0"
},
{
"model": "simatic wincc add-on pm-open pi",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-open import",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "6.0"
},
{
"model": "simatic wincc add-on pm-open host-s",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-open export",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-maint",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "simatic wincc add-on pm-control",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "10.0"
},
{
"model": "simatic wincc add-on pm-analyze",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-agent",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "simatic wincc add-on pi connect audit trail",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1.0"
},
{
"model": "simatic wincc add-on pi connect alarm",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "2.0"
},
{
"model": "simatic wincc add-on historian connect alarm",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "sentinel ldk",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.54"
},
{
"model": "sentinel hasp",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "hasp srm",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "sentinel ldk",
"scope": "ne",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.55"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "2.10"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "3.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "7.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "7.50"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:7.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11496"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sergey Temnikov and Vladimir Dashchenko from Kaspersky Lab",
"sources": [
{
"db": "BID",
"id": "102739"
}
],
"trust": 0.3
},
"cve": "CVE-2017-11496",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-11496",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-01325",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-11496",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-11496",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2018-01325",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-926",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-11496",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"db": "VULMON",
"id": "CVE-2017-11496"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via malformed ASN.1 streams in V2C and similar input files. Sentinel LDK Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SIMATIC WinCC is an automated data acquisition and monitoring control (SCADA) system. Gemalto Sentinel LDK RTE is a software protection and licensing solution. Gemalto Sentinel License Manager is prone to the following security vulnerabilities:\n1. Multiple stack-based buffer-overflow vulnerabilities. \n2. Multiple heap-based buffer-overflow vulnerabilities. \n3. A security bypass vulnerability. \n4. A denial-of-service vulnerability. \nAttackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. \nThe following Sentinel License Manger services are affected:\nGemalto HASP SRM\nGemalto Sentinel HASP\nGemalto Sentinel LDK products prior to Sentinel LDK RTE 7.55",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "VULMON",
"id": "CVE-2017-11496"
}
],
"trust": 2.97
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-11496",
"trust": 3.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-018-01",
"trust": 2.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-093-01",
"trust": 1.9
},
{
"db": "BID",
"id": "102906",
"trust": 1.4
},
{
"db": "BID",
"id": "102739",
"trust": 1.4
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-03",
"trust": 1.2
},
{
"db": "SIEMENS",
"id": "SSA-727467",
"trust": 1.1
},
{
"db": "SIEMENS",
"id": "SSA-127490",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2018-01325",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-926",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E1F201-39AB-11E9-80CC-000C29342CB1",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2017-11496",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"db": "VULMON",
"id": "CVE-2017-11496"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
]
},
"id": "VAR-201710-0969",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
}
],
"trust": 1.664732141875
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
}
]
},
"last_update_date": "2023-12-18T12:03:11.704000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Sentinel LDK",
"trust": 0.8,
"url": "https://sentinel.gemalto.com/software-monetization/sentinel-ldk/"
},
{
"title": "SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE component stack buffer overflow vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/113845"
},
{
"title": "Securelist",
"trust": 0.1,
"url": "https://securelist.com/a-silver-bullet-for-the-attacker/83661/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"db": "VULMON",
"id": "CVE-2017-11496"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"db": "NVD",
"id": "CVE-2017-11496"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-018-01"
},
{
"trust": 1.7,
"url": "https://www.iotvillage.org/slides_dc25/sergey_vlad_defcon_iot_village_public2017.pptx"
},
{
"trust": 1.7,
"url": "https://ics-cert.kaspersky.com/alerts/2017/07/28/multiple-vulnerabilities-found-in-popular-license-manager/"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-03"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/102739"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/102906"
},
{
"trust": 1.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-093-01"
},
{
"trust": 1.1,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf"
},
{
"trust": 0.9,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-127490.pdf"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11496"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-093-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11496"
},
{
"trust": 0.8,
"url": "https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-003-sentinel-ldk-rte-malformed-asn1-streams-in-v2c-files-lead-to-remote-code-execution/"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
},
{
"trust": 0.3,
"url": "https://sentinelcustomer.gemalto.com"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://securelist.com/a-silver-bullet-for-the-attacker/83661/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"db": "VULMON",
"id": "CVE-2017-11496"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"db": "VULMON",
"id": "CVE-2017-11496"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-19T00:00:00",
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"date": "2018-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"date": "2017-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11496"
},
{
"date": "2018-01-18T00:00:00",
"db": "BID",
"id": "102739"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2017-10-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"date": "2017-10-03T01:29:01.077000",
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"date": "2017-07-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-01325"
},
{
"date": "2018-05-11T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11496"
},
{
"date": "2018-01-18T00:00:00",
"db": "BID",
"id": "102739"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008950"
},
{
"date": "2018-05-11T01:29:00.950000",
"db": "NVD",
"id": "CVE-2017-11496"
},
{
"date": "2017-10-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE Component Stack Buffer Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01325"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "e2e1f201-39ab-11e9-80cc-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-926"
}
],
"trust": 0.8
}
}
VAR-201710-1104
Vulnerability from variot - Updated: 2023-12-18 12:03Arbitrary memory read from controlled memory pointer in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service. Gemalto Sentinel License Manager is prone to the following security vulnerabilities: 1. Multiple stack-based buffer-overflow vulnerabilities. 2. Multiple heap-based buffer-overflow vulnerabilities. 3. A security bypass vulnerability. 4. A denial-of-service vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Sentinel LDK is a license management tool
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-1104",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ldk rte",
"scope": "lte",
"trust": 1.0,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk rte",
"scope": "lt",
"trust": 0.8,
"vendor": "gemalto n v",
"version": "7.55"
},
{
"model": "ldk rte",
"scope": "eq",
"trust": 0.6,
"vendor": "sentinel",
"version": "7.50"
},
{
"model": "sentinel ldk",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.54"
},
{
"model": "sentinel hasp",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "hasp srm",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "sentinel ldk",
"scope": "ne",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.55"
}
],
"sources": [
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sentinel:sentinel_ldk_rte_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.50",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12820"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky Labs",
"sources": [
{
"db": "BID",
"id": "102906"
}
],
"trust": 0.3
},
"cve": "CVE-2017-12820",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-12820",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-103381",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-12820",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12820",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201708-495",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-103381",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-12820",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103381"
},
{
"db": "VULMON",
"id": "CVE-2017-12820"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Arbitrary memory read from controlled memory pointer in Gemalto\u0027s HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service. Gemalto Sentinel License Manager is prone to the following security vulnerabilities:\n1. Multiple stack-based buffer-overflow vulnerabilities. \n2. Multiple heap-based buffer-overflow vulnerabilities. \n3. A security bypass vulnerability. \n4. A denial-of-service vulnerability. \nAttackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. Sentinel LDK is a license management tool",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "VULHUB",
"id": "VHN-103381"
},
{
"db": "VULMON",
"id": "CVE-2017-12820"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12820",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-093-01",
"trust": 2.0
},
{
"db": "BID",
"id": "102906",
"trust": 1.5
},
{
"db": "SIEMENS",
"id": "SSA-727467",
"trust": 1.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-03",
"trust": 1.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-018-01",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201708-495",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-103381",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-12820",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103381"
},
{
"db": "VULMON",
"id": "CVE-2017-12820"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
]
},
"id": "VAR-201710-1104",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-103381"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:03:11.671000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://sentinelcustomer.gemalto.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103381"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"db": "NVD",
"id": "CVE-2017-12820"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2017/10/02/klcert-17-006-sentinel-ldk-rte-arbitrary-memory-read-from-controlled-memory-pointer-leads-to-remote-denial-of-service/"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/102906"
},
{
"trust": 1.2,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-093-01"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-03"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12820"
},
{
"trust": 0.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-018-01"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-093-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12820"
},
{
"trust": 0.3,
"url": "https://sentinelcustomer.gemalto.com"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-103381"
},
{
"db": "VULMON",
"id": "CVE-2017-12820"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-103381"
},
{
"db": "VULMON",
"id": "CVE-2017-12820"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-04T00:00:00",
"db": "VULHUB",
"id": "VHN-103381"
},
{
"date": "2017-10-04T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12820"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2017-11-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"date": "2017-10-04T01:29:02.213000",
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"date": "2017-08-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-11T00:00:00",
"db": "VULHUB",
"id": "VHN-103381"
},
{
"date": "2018-05-11T00:00:00",
"db": "VULMON",
"id": "CVE-2017-12820"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009452"
},
{
"date": "2018-05-11T01:29:01.670000",
"db": "NVD",
"id": "CVE-2017-12820"
},
{
"date": "2017-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Gemalto Product Sentinel LDK RTE Firmware buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009452"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-495"
}
],
"trust": 0.6
}
}
VAR-201710-0971
Vulnerability from variot - Updated: 2023-12-18 12:03Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to shut down the remote process (a denial of service) via a language pack (ZIP file) with invalid HTML files. Sentinel LDK Contains a buffer error vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SIMATIC WinCC is an automated data acquisition and monitoring control (SCADA) system. Gemalto Sentinel LDK RTE is a software protection and licensing solution. A denial of service vulnerability exists in the SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE component. Gemalto Sentinel License Manager is prone to the following security vulnerabilities: 1. Multiple stack-based buffer-overflow vulnerabilities. 2. Multiple heap-based buffer-overflow vulnerabilities. 3. A security bypass vulnerability. 4. A denial-of-service vulnerability. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. The following Sentinel License Manger services are affected: Gemalto HASP SRM Gemalto Sentinel HASP Gemalto Sentinel LDK products prior to Sentinel LDK RTE 7.55
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0971",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "2.10"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "7.50"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "7.1"
},
{
"model": "sentinel ldk rte",
"scope": "eq",
"trust": 1.6,
"vendor": "gemalto",
"version": "3.0"
},
{
"model": "sentinel ldk",
"scope": null,
"trust": 0.8,
"vendor": "gemalto n v",
"version": null
},
{
"model": "simatic wincc add-on historian connect alarm",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v5.x"
},
{
"model": "simatic wincc add-on pi connect alarm",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v2.x"
},
{
"model": "simatic wincc add-on pi connect audit trail",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v1.x"
},
{
"model": "simatic wincc add-on pm-agent",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v5.x"
},
{
"model": "simatic wincc add-on pm-analyze",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-control",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v10.x"
},
{
"model": "simatic wincc add-on pm-maint",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v9.x"
},
{
"model": "simatic wincc add-on pm-open export",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open host-s",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open import",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v6.x"
},
{
"model": "simatic wincc add-on pm-open pi",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on pm-open pv02",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v1.x"
},
{
"model": "simatic wincc add-on pm-open tcp/ip",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v8.x"
},
{
"model": "simatic wincc add-on pm-quality",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v9.x"
},
{
"model": "simatic wincc add-on sicement it mis",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on sipaper it mis",
"scope": "lte",
"trust": 0.6,
"vendor": "siemens",
"version": "\u003c=v7.x"
},
{
"model": "simatic wincc add-on sipaper it mis",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on sicement it mis and",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-quality",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "simatic wincc add-on pm-open tcp/ip",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.0"
},
{
"model": "simatic wincc add-on pm-open pv02",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1.0"
},
{
"model": "simatic wincc add-on pm-open pi",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-open import",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "6.0"
},
{
"model": "simatic wincc add-on pm-open host-s",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-open export",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-maint",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "simatic wincc add-on pm-control",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "10.0"
},
{
"model": "simatic wincc add-on pm-analyze",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "7.0"
},
{
"model": "simatic wincc add-on pm-agent",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "simatic wincc add-on pi connect audit trail",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1.0"
},
{
"model": "simatic wincc add-on pi connect alarm",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "2.0"
},
{
"model": "simatic wincc add-on historian connect alarm",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "5.0"
},
{
"model": "sentinel ldk",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.54"
},
{
"model": "sentinel hasp",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "hasp srm",
"scope": "eq",
"trust": 0.3,
"vendor": "gemalto",
"version": "0"
},
{
"model": "sentinel ldk",
"scope": "ne",
"trust": 0.3,
"vendor": "gemalto",
"version": "7.55"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "2.10"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "3.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "7.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sentinel ldk rte",
"version": "7.50"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gemalto:sentinel_ldk_rte:7.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11498"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sergey Temnikov and Vladimir Dashchenko from Kaspersky Lab",
"sources": [
{
"db": "BID",
"id": "102739"
}
],
"trust": 0.3
},
"cve": "CVE-2017-11498",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-11498",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-01327",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2017-11498",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-11498",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2018-01327",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-924",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-11498",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"db": "VULMON",
"id": "CVE-2017-11498"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to shut down the remote process (a denial of service) via a language pack (ZIP file) with invalid HTML files. Sentinel LDK Contains a buffer error vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SIMATIC WinCC is an automated data acquisition and monitoring control (SCADA) system. Gemalto Sentinel LDK RTE is a software protection and licensing solution. A denial of service vulnerability exists in the SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE component. Gemalto Sentinel License Manager is prone to the following security vulnerabilities:\n1. Multiple stack-based buffer-overflow vulnerabilities. \n2. Multiple heap-based buffer-overflow vulnerabilities. \n3. A security bypass vulnerability. \n4. A denial-of-service vulnerability. \nAttackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. \nThe following Sentinel License Manger services are affected:\nGemalto HASP SRM\nGemalto Sentinel HASP\nGemalto Sentinel LDK products prior to Sentinel LDK RTE 7.55",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "VULMON",
"id": "CVE-2017-11498"
}
],
"trust": 2.97
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-11498",
"trust": 3.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-018-01",
"trust": 2.2
},
{
"db": "ICS CERT",
"id": "ICSA-18-093-01",
"trust": 1.9
},
{
"db": "BID",
"id": "102906",
"trust": 1.4
},
{
"db": "BID",
"id": "102739",
"trust": 1.4
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-03",
"trust": 1.2
},
{
"db": "SIEMENS",
"id": "SSA-727467",
"trust": 1.1
},
{
"db": "SIEMENS",
"id": "SSA-127490",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2018-01327",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-924",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E2401E-39AB-11E9-B098-000C29342CB1",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2017-11498",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"db": "VULMON",
"id": "CVE-2017-11498"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
]
},
"id": "VAR-201710-0971",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
}
],
"trust": 1.664732141875
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
}
]
},
"last_update_date": "2023-12-18T12:03:11.623000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Sentinel LDK",
"trust": 0.8,
"url": "https://sentinel.gemalto.com/software-monetization/sentinel-ldk/"
},
{
"title": "SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE component denial of service vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/113849"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"db": "NVD",
"id": "CVE-2017-11498"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-001-sentinel-ldk-rte-language-pack-with-invalid-html-files-leads-to-denial-of-service/"
},
{
"trust": 2.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-018-01"
},
{
"trust": 1.7,
"url": "https://www.iotvillage.org/slides_dc25/sergey_vlad_defcon_iot_village_public2017.pptx"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/102739"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-03"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/102906"
},
{
"trust": 1.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-093-01"
},
{
"trust": 1.1,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf"
},
{
"trust": 0.9,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-127490.pdf"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11498"
},
{
"trust": 0.8,
"url": "https://www.us-cert.gov/ics/advisories/icsa-18-093-01"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11498"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
},
{
"trust": 0.3,
"url": "https://sentinelcustomer.gemalto.com"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"db": "VULMON",
"id": "CVE-2017-11498"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"db": "VULMON",
"id": "CVE-2017-11498"
},
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-19T00:00:00",
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"date": "2018-01-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"date": "2017-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11498"
},
{
"date": "2018-01-18T00:00:00",
"db": "BID",
"id": "102739"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2017-10-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"date": "2017-10-03T01:29:01.153000",
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"date": "2017-07-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-01327"
},
{
"date": "2018-05-11T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11498"
},
{
"date": "2018-01-18T00:00:00",
"db": "BID",
"id": "102739"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102906"
},
{
"date": "2019-07-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008952"
},
{
"date": "2018-05-11T01:29:01.093000",
"db": "NVD",
"id": "CVE-2017-11498"
},
{
"date": "2017-10-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "102739"
},
{
"db": "BID",
"id": "102906"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SIEMENS SIMATIC WinCC Add-On Gemalto Sentinel LDK RTE Component Denial of Service Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-01327"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "e2e2401e-39ab-11e9-b098-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-924"
}
],
"trust": 0.8
}
}
CVE-2019-18232 (GCVE-0-2019-18232)
Vulnerability from cvelistv5 – Published: 2019-12-11 22:22 – Updated: 2024-08-05 01:47
VLAI
Summary
SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading to a privilege escalation. This vulnerability could also be used by an attacker to execute a malicious DLL, which could impact the integrity and availability of the system.
Severity
No CVSS data available.
CWE
- CWE-59 - IMPROPER LINK RESOLUTION BEFORE FILE ACCESS ('LINK FOLLOWING') CWE-59
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-19-339-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | SafeNet Sentinel LDK License Manager Runtime |
Affected:
All versions prior to 7.101(only Microsoft Windows versions are affected)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:47:14.069Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SafeNet Sentinel LDK License Manager Runtime",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All versions prior to 7.101(only Microsoft Windows versions are affected)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading to a privilege escalation. This vulnerability could also be used by an attacker to execute a malicious DLL, which could impact the integrity and availability of the system."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "IMPROPER LINK RESOLUTION BEFORE FILE ACCESS (\u0027LINK FOLLOWING\u0027) CWE-59",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-11T22:22:42.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2019-18232",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SafeNet Sentinel LDK License Manager Runtime",
"version": {
"version_data": [
{
"version_value": "All versions prior to 7.101(only Microsoft Windows versions are affected)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading to a privilege escalation. This vulnerability could also be used by an attacker to execute a malicious DLL, which could impact the integrity and availability of the system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "IMPROPER LINK RESOLUTION BEFORE FILE ACCESS (\u0027LINK FOLLOWING\u0027) CWE-59"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2019-18232",
"datePublished": "2019-12-11T22:22:42.000Z",
"dateReserved": "2019-10-22T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:47:14.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-8282 (GCVE-0-2019-8282)
Vulnerability from cvelistv5 – Published: 2019-06-07 14:21 – Updated: 2024-08-04 21:17
VLAI
Summary
Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.
Severity
No CVSS data available.
CWE
- CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://ics-cert.kaspersky.com/advisories/klcert-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Sentinel LDK RTE |
Affected:
7.91
|
Date Public
2019-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:17:31.269Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Sentinel LDK RTE",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "7.91"
}
]
}
],
"datePublic": "2019-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-300",
"description": "CWE-300: Channel Accessible by Non-Endpoint (\u0027Man-in-the-Middle\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-07T14:21:01.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"ID": "CVE-2019-8282",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "7.91"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-300: Channel Accessible by Non-Endpoint (\u0027Man-in-the-Middle\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/",
"refsource": "MISC",
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2019-8282",
"datePublished": "2019-06-07T14:21:01.000Z",
"dateReserved": "2019-02-12T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:17:31.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-8283 (GCVE-0-2019-8283)
Vulnerability from cvelistv5 – Published: 2019-06-07 14:18 – Updated: 2024-08-04 21:17
VLAI
Summary
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.
Severity
No CVSS data available.
CWE
- CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://ics-cert.kaspersky.com/advisories/klcert-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Sentinel LDK RTE |
Affected:
7.91
|
Date Public
2019-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:17:30.496Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Sentinel LDK RTE",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "7.91"
}
]
}
],
"datePublic": "2019-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have \u0027HttpOnly\u0027 flag. This allows malicious javascript to steal it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1004",
"description": "CWE-1004: Sensitive Cookie Without \u0027HttpOnly\u0027 Flag",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-07T14:18:05.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"ID": "CVE-2019-8283",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "7.91"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have \u0027HttpOnly\u0027 flag. This allows malicious javascript to steal it."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1004: Sensitive Cookie Without \u0027HttpOnly\u0027 Flag"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/",
"refsource": "MISC",
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2019-8283",
"datePublished": "2019-06-07T14:18:05.000Z",
"dateReserved": "2019-02-12T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:17:30.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9156 (GCVE-0-2019-9156)
Vulnerability from cvelistv5 – Published: 2019-06-05 18:27 – Updated: 2024-08-04 21:38
VLAI
Summary
Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.sec-consult.com/en/vulnerability-lab/… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/May/6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.581Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-05T18:27:42.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9156",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html",
"refsource": "MISC",
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"name": "http://seclists.org/fulldisclosure/2019/May/6",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9156",
"datePublished": "2019-06-05T18:27:42.000Z",
"dateReserved": "2019-02-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:38:46.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9157 (GCVE-0-2019-9157)
Vulnerability from cvelistv5 – Published: 2019-06-05 18:25 – Updated: 2024-08-04 21:38
VLAI
Summary
Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.sec-consult.com/en/vulnerability-lab/… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/May/6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.575Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-05T18:25:32.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9157",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html",
"refsource": "MISC",
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"name": "http://seclists.org/fulldisclosure/2019/May/6",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9157",
"datePublished": "2019-06-05T18:25:32.000Z",
"dateReserved": "2019-02-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:38:46.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9158 (GCVE-0-2019-9158)
Vulnerability from cvelistv5 – Published: 2019-06-05 18:16 – Updated: 2024-08-04 21:38
VLAI
Summary
Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.sec-consult.com/en/vulnerability-lab/… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/May/6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-05T18:16:57.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9158",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html",
"refsource": "MISC",
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"name": "http://seclists.org/fulldisclosure/2019/May/6",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9158",
"datePublished": "2019-06-05T18:16:57.000Z",
"dateReserved": "2019-02-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:38:46.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-6534 (GCVE-0-2019-6534)
Vulnerability from cvelistv5 – Published: 2019-04-11 20:38 – Updated: 2024-08-04 20:23
VLAI
Summary
The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file.
Severity
No CVSS data available.
CWE
- CWE-427 - UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02 | x_refsource_MISC |
| https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01 | x_refsource_MISC |
| https://supportportal.gemalto.com/csm?id=kb_artic… | x_refsource_MISC |
| https://sw.aveva.com/hubfs/assets-2018/pdf/securi… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gemalto | Sentinel UltraPro |
Affected:
Client Library ux32w.dll Version 1.3.0
Affected: Client Library ux32w.dll Version 1.3.1 Affected: Client Library ux32w.dll Version 1.3.2 |
Date Public
2019-03-14 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:23:21.993Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Sentinel UltraPro",
"vendor": "Gemalto",
"versions": [
{
"status": "affected",
"version": "Client Library ux32w.dll Version 1.3.0"
},
{
"status": "affected",
"version": "Client Library ux32w.dll Version 1.3.1"
},
{
"status": "affected",
"version": "Client Library ux32w.dll Version 1.3.2"
}
]
}
],
"datePublic": "2019-03-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-11T20:38:50.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2019-6534",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel UltraPro",
"version": {
"version_data": [
{
"version_value": "Client Library ux32w.dll Version 1.3.0"
},
{
"version_value": "Client Library ux32w.dll Version 1.3.1"
},
{
"version_value": "Client Library ux32w.dll Version 1.3.2"
}
]
}
}
]
},
"vendor_name": "Gemalto"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01"
},
{
"name": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694",
"refsource": "MISC",
"url": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694"
},
{
"name": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf",
"refsource": "CONFIRM",
"url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2019-6534",
"datePublished": "2019-04-11T20:38:50.000Z",
"dateReserved": "2019-01-22T00:00:00.000Z",
"dateUpdated": "2024-08-04T20:23:21.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-15492 (GCVE-0-2018-15492)
Vulnerability from cvelistv5 – Published: 2018-08-18 02:00 – Updated: 2024-08-05 09:54
VLAI
Summary
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.radware.com/app/answers/answer_vi… | x_refsource_MISC |
| https://github.com/mspaling/sentinel-ddos-signatu… | x_refsource_MISC |
Date Public
2018-08-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T09:54:03.410Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-08-18T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-15492",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos",
"refsource": "MISC",
"url": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos"
},
{
"name": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt",
"refsource": "MISC",
"url": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-15492",
"datePublished": "2018-08-18T02:00:00.000Z",
"dateReserved": "2018-08-17T00:00:00.000Z",
"dateUpdated": "2024-08-05T09:54:03.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-8900 (GCVE-0-2018-8900)
Vulnerability from cvelistv5 – Published: 2018-05-02 21:00 – Updated: 2024-08-05 07:10
VLAI
Summary
The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
| https://drive.google.com/file/d/18BaBzGcjWAfJyZ_p… | x_refsource_MISC |
Date Public
2018-04-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:10:47.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-13T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-8900",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"name": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing",
"refsource": "MISC",
"url": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-8900",
"datePublished": "2018-05-02T21:00:00.000Z",
"dateReserved": "2018-03-21T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:10:47.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-6304 (GCVE-0-2018-6304)
Vulnerability from cvelistv5 – Published: 2018-03-13 17:00 – Updated: 2024-09-16 18:09
VLAI
Summary
Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service
Severity
No CVSS data available.
CWE
- Stack overflow in custom XML-parser leads to remote denial of service
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
| https://sentinel.gemalto.com/technical-support/se… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gemalto | Gemalto's Sentinel LDK RTE |
Affected:
before 7.65
|
Date Public
2018-03-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:48.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Gemalto\u0027s Sentinel LDK RTE",
"vendor": "Gemalto",
"versions": [
{
"status": "affected",
"version": "before 7.65"
}
]
}
],
"datePublic": "2018-03-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stack overflow in custom XML-parser in Gemalto\u0027s Sentinel LDK RTE version before 7.65 leads to remote denial of service"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Stack overflow in custom XML-parser leads to remote denial of service",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-13T09:57:01.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"DATE_PUBLIC": "2018-03-13T00:00:00",
"ID": "CVE-2018-6304",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Gemalto\u0027s Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "before 7.65"
}
]
}
}
]
},
"vendor_name": "Gemalto"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack overflow in custom XML-parser in Gemalto\u0027s Sentinel LDK RTE version before 7.65 leads to remote denial of service"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Stack overflow in custom XML-parser leads to remote denial of service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"name": "https://sentinel.gemalto.com/technical-support/security-updates-sm/",
"refsource": "MISC",
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2018-6304",
"datePublished": "2018-03-13T17:00:00.000Z",
"dateReserved": "2018-01-25T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:09:19.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-6305 (GCVE-0-2018-6305)
Vulnerability from cvelistv5 – Published: 2018-03-13 17:00 – Updated: 2024-09-17 03:17
VLAI
Summary
Denial of service in Gemalto's Sentinel LDK RTE version before 7.65
Severity
No CVSS data available.
CWE
- Denial of service
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
| https://sentinel.gemalto.com/technical-support/se… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gemalto | Gemalto's Sentinel LDK RTE |
Affected:
before 7.65
|
Date Public
2018-03-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:48.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Gemalto\u0027s Sentinel LDK RTE",
"vendor": "Gemalto",
"versions": [
{
"status": "affected",
"version": "before 7.65"
}
]
}
],
"datePublic": "2018-03-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Denial of service in Gemalto\u0027s Sentinel LDK RTE version before 7.65"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of service",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-13T09:57:01.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"DATE_PUBLIC": "2018-03-13T00:00:00",
"ID": "CVE-2018-6305",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Gemalto\u0027s Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "before 7.65"
}
]
}
}
]
},
"vendor_name": "Gemalto"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Denial of service in Gemalto\u0027s Sentinel LDK RTE version before 7.65"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"name": "https://sentinel.gemalto.com/technical-support/security-updates-sm/",
"refsource": "MISC",
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2018-6305",
"datePublished": "2018-03-13T17:00:00.000Z",
"dateReserved": "2018-01-25T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:17:47.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-18232 (GCVE-0-2019-18232)
Vulnerability from nvd – Published: 2019-12-11 22:22 – Updated: 2024-08-05 01:47
VLAI
Summary
SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading to a privilege escalation. This vulnerability could also be used by an attacker to execute a malicious DLL, which could impact the integrity and availability of the system.
Severity
No CVSS data available.
CWE
- CWE-59 - IMPROPER LINK RESOLUTION BEFORE FILE ACCESS ('LINK FOLLOWING') CWE-59
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-19-339-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | SafeNet Sentinel LDK License Manager Runtime |
Affected:
All versions prior to 7.101(only Microsoft Windows versions are affected)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:47:14.069Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SafeNet Sentinel LDK License Manager Runtime",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All versions prior to 7.101(only Microsoft Windows versions are affected)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading to a privilege escalation. This vulnerability could also be used by an attacker to execute a malicious DLL, which could impact the integrity and availability of the system."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "IMPROPER LINK RESOLUTION BEFORE FILE ACCESS (\u0027LINK FOLLOWING\u0027) CWE-59",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-11T22:22:42.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2019-18232",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SafeNet Sentinel LDK License Manager Runtime",
"version": {
"version_data": [
{
"version_value": "All versions prior to 7.101(only Microsoft Windows versions are affected)"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading to a privilege escalation. This vulnerability could also be used by an attacker to execute a malicious DLL, which could impact the integrity and availability of the system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "IMPROPER LINK RESOLUTION BEFORE FILE ACCESS (\u0027LINK FOLLOWING\u0027) CWE-59"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-339-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2019-18232",
"datePublished": "2019-12-11T22:22:42.000Z",
"dateReserved": "2019-10-22T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:47:14.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-8282 (GCVE-0-2019-8282)
Vulnerability from nvd – Published: 2019-06-07 14:21 – Updated: 2024-08-04 21:17
VLAI
Summary
Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.
Severity
No CVSS data available.
CWE
- CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://ics-cert.kaspersky.com/advisories/klcert-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Sentinel LDK RTE |
Affected:
7.91
|
Date Public
2019-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:17:31.269Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Sentinel LDK RTE",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "7.91"
}
]
}
],
"datePublic": "2019-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-300",
"description": "CWE-300: Channel Accessible by Non-Endpoint (\u0027Man-in-the-Middle\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-07T14:21:01.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"ID": "CVE-2019-8282",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "7.91"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-300: Channel Accessible by Non-Endpoint (\u0027Man-in-the-Middle\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/",
"refsource": "MISC",
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2019-8282",
"datePublished": "2019-06-07T14:21:01.000Z",
"dateReserved": "2019-02-12T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:17:31.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-8283 (GCVE-0-2019-8283)
Vulnerability from nvd – Published: 2019-06-07 14:18 – Updated: 2024-08-04 21:17
VLAI
Summary
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.
Severity
No CVSS data available.
CWE
- CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://ics-cert.kaspersky.com/advisories/klcert-… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Sentinel LDK RTE |
Affected:
7.91
|
Date Public
2019-06-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:17:30.496Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Sentinel LDK RTE",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "7.91"
}
]
}
],
"datePublic": "2019-06-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have \u0027HttpOnly\u0027 flag. This allows malicious javascript to steal it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1004",
"description": "CWE-1004: Sensitive Cookie Without \u0027HttpOnly\u0027 Flag",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-07T14:18:05.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"ID": "CVE-2019-8283",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "7.91"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have \u0027HttpOnly\u0027 flag. This allows malicious javascript to steal it."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1004: Sensitive Cookie Without \u0027HttpOnly\u0027 Flag"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/",
"refsource": "MISC",
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2019-8283",
"datePublished": "2019-06-07T14:18:05.000Z",
"dateReserved": "2019-02-12T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:17:30.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9156 (GCVE-0-2019-9156)
Vulnerability from nvd – Published: 2019-06-05 18:27 – Updated: 2024-08-04 21:38
VLAI
Summary
Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.sec-consult.com/en/vulnerability-lab/… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/May/6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.581Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-05T18:27:42.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9156",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html",
"refsource": "MISC",
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"name": "http://seclists.org/fulldisclosure/2019/May/6",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9156",
"datePublished": "2019-06-05T18:27:42.000Z",
"dateReserved": "2019-02-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:38:46.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9157 (GCVE-0-2019-9157)
Vulnerability from nvd – Published: 2019-06-05 18:25 – Updated: 2024-08-04 21:38
VLAI
Summary
Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.sec-consult.com/en/vulnerability-lab/… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/May/6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.575Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-05T18:25:32.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9157",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html",
"refsource": "MISC",
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"name": "http://seclists.org/fulldisclosure/2019/May/6",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9157",
"datePublished": "2019-06-05T18:25:32.000Z",
"dateReserved": "2019-02-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:38:46.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-9158 (GCVE-0-2019-9158)
Vulnerability from nvd – Published: 2019-06-05 18:16 – Updated: 2024-08-04 21:38
VLAI
Summary
Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.sec-consult.com/en/vulnerability-lab/… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/May/6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-05T18:16:57.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9158",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html",
"refsource": "MISC",
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"name": "http://seclists.org/fulldisclosure/2019/May/6",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2019/May/6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9158",
"datePublished": "2019-06-05T18:16:57.000Z",
"dateReserved": "2019-02-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:38:46.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-6534 (GCVE-0-2019-6534)
Vulnerability from nvd – Published: 2019-04-11 20:38 – Updated: 2024-08-04 20:23
VLAI
Summary
The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file.
Severity
No CVSS data available.
CWE
- CWE-427 - UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02 | x_refsource_MISC |
| https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01 | x_refsource_MISC |
| https://supportportal.gemalto.com/csm?id=kb_artic… | x_refsource_MISC |
| https://sw.aveva.com/hubfs/assets-2018/pdf/securi… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gemalto | Sentinel UltraPro |
Affected:
Client Library ux32w.dll Version 1.3.0
Affected: Client Library ux32w.dll Version 1.3.1 Affected: Client Library ux32w.dll Version 1.3.2 |
Date Public
2019-03-14 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:23:21.993Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Sentinel UltraPro",
"vendor": "Gemalto",
"versions": [
{
"status": "affected",
"version": "Client Library ux32w.dll Version 1.3.0"
},
{
"status": "affected",
"version": "Client Library ux32w.dll Version 1.3.1"
},
{
"status": "affected",
"version": "Client Library ux32w.dll Version 1.3.2"
}
]
}
],
"datePublic": "2019-03-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-11T20:38:50.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2019-6534",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Sentinel UltraPro",
"version": {
"version_data": [
{
"version_value": "Client Library ux32w.dll Version 1.3.0"
},
{
"version_value": "Client Library ux32w.dll Version 1.3.1"
},
{
"version_value": "Client Library ux32w.dll Version 1.3.2"
}
]
}
}
]
},
"vendor_name": "Gemalto"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "UNCONTROLLED SEARCH PATH ELEMENT CWE-427"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-073-02"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-078-01"
},
{
"name": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694",
"refsource": "MISC",
"url": "https://supportportal.gemalto.com/csm?id=kb_article_view\u0026sysparm_article=KB0017694"
},
{
"name": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf",
"refsource": "CONFIRM",
"url": "https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec131.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2019-6534",
"datePublished": "2019-04-11T20:38:50.000Z",
"dateReserved": "2019-01-22T00:00:00.000Z",
"dateUpdated": "2024-08-04T20:23:21.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-15492 (GCVE-0-2018-15492)
Vulnerability from nvd – Published: 2018-08-18 02:00 – Updated: 2024-08-05 09:54
VLAI
Summary
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.radware.com/app/answers/answer_vi… | x_refsource_MISC |
| https://github.com/mspaling/sentinel-ddos-signatu… | x_refsource_MISC |
Date Public
2018-08-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T09:54:03.410Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-08-18T01:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-15492",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos",
"refsource": "MISC",
"url": "https://support.radware.com/app/answers/answer_view/a_id/17879/~/security-advisory-sentinel-reflection-ddos"
},
{
"name": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt",
"refsource": "MISC",
"url": "https://github.com/mspaling/sentinel-ddos-signature/blob/master/sentinel-ddos-signature.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-15492",
"datePublished": "2018-08-18T02:00:00.000Z",
"dateReserved": "2018-08-17T00:00:00.000Z",
"dateUpdated": "2024-08-05T09:54:03.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-8900 (GCVE-0-2018-8900)
Vulnerability from nvd – Published: 2018-05-02 21:00 – Updated: 2024-08-05 07:10
VLAI
Summary
The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
| https://drive.google.com/file/d/18BaBzGcjWAfJyZ_p… | x_refsource_MISC |
Date Public
2018-04-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:10:47.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-13T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-8900",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"name": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing",
"refsource": "MISC",
"url": "https://drive.google.com/file/d/18BaBzGcjWAfJyZ_phWEVerYmmLB-vxF-/view?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-8900",
"datePublished": "2018-05-02T21:00:00.000Z",
"dateReserved": "2018-03-21T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:10:47.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-6304 (GCVE-0-2018-6304)
Vulnerability from nvd – Published: 2018-03-13 17:00 – Updated: 2024-09-16 18:09
VLAI
Summary
Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service
Severity
No CVSS data available.
CWE
- Stack overflow in custom XML-parser leads to remote denial of service
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
| https://sentinel.gemalto.com/technical-support/se… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gemalto | Gemalto's Sentinel LDK RTE |
Affected:
before 7.65
|
Date Public
2018-03-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:48.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Gemalto\u0027s Sentinel LDK RTE",
"vendor": "Gemalto",
"versions": [
{
"status": "affected",
"version": "before 7.65"
}
]
}
],
"datePublic": "2018-03-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stack overflow in custom XML-parser in Gemalto\u0027s Sentinel LDK RTE version before 7.65 leads to remote denial of service"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Stack overflow in custom XML-parser leads to remote denial of service",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-13T09:57:01.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"DATE_PUBLIC": "2018-03-13T00:00:00",
"ID": "CVE-2018-6304",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Gemalto\u0027s Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "before 7.65"
}
]
}
}
]
},
"vendor_name": "Gemalto"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack overflow in custom XML-parser in Gemalto\u0027s Sentinel LDK RTE version before 7.65 leads to remote denial of service"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Stack overflow in custom XML-parser leads to remote denial of service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"name": "https://sentinel.gemalto.com/technical-support/security-updates-sm/",
"refsource": "MISC",
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2018-6304",
"datePublished": "2018-03-13T17:00:00.000Z",
"dateReserved": "2018-01-25T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:09:19.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-6305 (GCVE-0-2018-6305)
Vulnerability from nvd – Published: 2018-03-13 17:00 – Updated: 2024-09-17 03:17
VLAI
Summary
Denial of service in Gemalto's Sentinel LDK RTE version before 7.65
Severity
No CVSS data available.
CWE
- Denial of service
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
| https://sentinel.gemalto.com/technical-support/se… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gemalto | Gemalto's Sentinel LDK RTE |
Affected:
before 7.65
|
Date Public
2018-03-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:48.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Gemalto\u0027s Sentinel LDK RTE",
"vendor": "Gemalto",
"versions": [
{
"status": "affected",
"version": "before 7.65"
}
]
}
],
"datePublic": "2018-03-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Denial of service in Gemalto\u0027s Sentinel LDK RTE version before 7.65"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Denial of service",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-13T09:57:01.000Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"DATE_PUBLIC": "2018-03-13T00:00:00",
"ID": "CVE-2018-6305",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Gemalto\u0027s Sentinel LDK RTE",
"version": {
"version_data": [
{
"version_value": "before 7.65"
}
]
}
}
]
},
"vendor_name": "Gemalto"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Denial of service in Gemalto\u0027s Sentinel LDK RTE version before 7.65"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of service"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf"
},
{
"name": "https://sentinel.gemalto.com/technical-support/security-updates-sm/",
"refsource": "MISC",
"url": "https://sentinel.gemalto.com/technical-support/security-updates-sm/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2018-6305",
"datePublished": "2018-03-13T17:00:00.000Z",
"dateReserved": "2018-01-25T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:17:47.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}