Vulnerability-Lookup

CNVD-2015-01597

Vulnerability from cnvd - Published: 2015-03-12

Title

HP Point of Sale PCs Running Windows with OPOS Drivers任意代码执行漏洞（CNVD-2015-01597）

Description

HP Point of Sale PCs Running Windows with OPOS Drivers是美国惠普（HP）公司的一套运行于惠普销售点终端机Windows操作系统中的OPOS驱动程序。 HP Point of Sale PCs Running Windows with OPOS Drivers 1.13.003之前版本的多款打印机设备中的OPOSCheckScanner.ocx文件存在安全漏洞。远程攻击者可利用该漏洞执行任意代码。

Severity

中

Patch Name

HP Point of Sale PCs Running Windows with OPOS Drivers任意代码执行漏洞（CNVD-2015-01597）的补丁

Patch Description

HP Point of Sale PCs Running Windows with OPOS Drivers是美国惠普（HP）公司的一套运行于惠普销售点终端机Windows操作系统中的OPOS驱动程序。HP Point of Sale PCs Running Windows with OPOS Drivers 1.13.003之前版本的多款打印机设备中的OPOSCheckScanner.ocx文件存在安全漏洞。远程攻击者可利用该漏洞执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185

Reference

https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185

Impacted products

Name
HP OLE Point of Sale (OPOS) drivers <1.13.003

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-7893"
    }
  },
  "description": "HP Point of Sale PCs Running Windows with OPOS Drivers\u662f\u7f8e\u56fd\u60e0\u666e\uff08HP\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fd0\u884c\u4e8e\u60e0\u666e\u9500\u552e\u70b9\u7ec8\u7aef\u673aWindows\u64cd\u4f5c\u7cfb\u7edf\u4e2d\u7684OPOS\u9a71\u52a8\u7a0b\u5e8f\u3002\r\n\r\nHP Point of Sale PCs Running Windows with OPOS Drivers 1.13.003\u4e4b\u524d\u7248\u672c\u7684\u591a\u6b3e\u6253\u5370\u673a\u8bbe\u5907\u4e2d\u7684OPOSCheckScanner.ocx\u6587\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "HP",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-01597",
  "openTime": "2015-03-12",
  "patchDescription": "HP Point of Sale PCs Running Windows with OPOS Drivers\u662f\u7f8e\u56fd\u60e0\u666e\uff08HP\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fd0\u884c\u4e8e\u60e0\u666e\u9500\u552e\u70b9\u7ec8\u7aef\u673aWindows\u64cd\u4f5c\u7cfb\u7edf\u4e2d\u7684OPOS\u9a71\u52a8\u7a0b\u5e8f\u3002HP Point of Sale PCs Running Windows with OPOS Drivers 1.13.003\u4e4b\u524d\u7248\u672c\u7684\u591a\u6b3e\u6253\u5370\u673a\u8bbe\u5907\u4e2d\u7684OPOSCheckScanner.ocx\u6587\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "HP Point of Sale PCs Running Windows with OPOS Drivers\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2015-01597\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "HP OLE Point of Sale (OPOS) drivers \u003c1.13.003"
  },
  "referenceLink": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185",
  "serverity": "\u4e2d",
  "submitTime": "2015-03-11",
  "title": "HP Point of Sale PCs Running Windows with OPOS Drivers\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2015-01597\uff09"
}

CVE-2014-7893 (GCVE-0-2014-7893)

Vulnerability from cvelistv5 – Published: 2015-03-09 17:00 – Updated: 2024-08-06 13:03

Summary

The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCheckScanner.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, and Value Serial/USB Receipt printers, aka ZDI-CAN-2507.

Severity ?

No CVSS data available.

CWE

Assigner

References

URL

Tags

	http://www.securitytracker.com/id/1031840	vdb-entryx_refsource_SECTRACK
	https://h20564.www2.hp.com/portal/site/hpsc/publi…	vendor-advisoryx_refsource_HP
	https://h20564.www2.hp.com/portal/site/hpsc/publi…	vendor-advisoryx_refsource_HP

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:03:27.607Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1031840",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031840"
          },
          {
            "name": "SSRT101691",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"
          },
          {
            "name": "HPSBHF03279",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-03-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCheckScanner.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, and Value Serial/USB Receipt printers, aka ZDI-CAN-2507."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-03-10T13:57:00",
        "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
        "shortName": "hp"
      },
      "references": [
        {
          "name": "1031840",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031840"
        },
        {
          "name": "SSRT101691",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"
        },
        {
          "name": "HPSBHF03279",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "hp-security-alert@hp.com",
          "ID": "CVE-2014-7893",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSCheckScanner.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, and Value Serial/USB Receipt printers, aka ZDI-CAN-2507."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1031840",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031840"
            },
            {
              "name": "SSRT101691",
              "refsource": "HP",
              "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"
            },
            {
              "name": "HPSBHF03279",
              "refsource": "HP",
              "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
    "assignerShortName": "hp",
    "cveId": "CVE-2014-7893",
    "datePublished": "2015-03-09T17:00:00",
    "dateReserved": "2014-10-06T00:00:00",
    "dateUpdated": "2024-08-06T13:03:27.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2015-01597

CVE-2014-7893 (GCVE-0-2014-7893)

Tags

Sightings

Nomenclature