Vulnerability-Lookup

CNVD-2017-10575

Vulnerability from cnvd - Published: 2017-06-22

Title

B. Braun SpaceCom Module开放重定向漏洞

Description

B. Braun SpaceCom Module 是一款用于促进医疗系统信息交流的产品，用于连接医院网络系统和外部临床系统，向已连接的工作站输入数据、医疗历史和服务信息等。 B. Braun SpaceCom module存在开放重定向漏洞，该漏洞源于未能充分验证用户输入。攻击者可以利用该漏洞发布一个特制的URI并诱导用户点击，将用户重定向到攻击者控制的网站，造成钓鱼攻击。

Severity

中

Patch Name

B. Braun SpaceCom Module开放重定向漏洞的补丁

Patch Description

B. Braun SpaceCom Module 是一款用于促进医疗系统信息交流的产品，用于连接医院网络系统和外部临床系统，向已连接的工作站输注数据、医疗历史和服务信息等。 B. Braun SpaceCom module存在开放重定向漏洞，该漏洞源于没有充分验证用户输入。攻击者可以利用该漏洞发布一个特制的URI并诱导用户点击，将用户重定向到攻击者控制的网站，造成钓鱼攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下厂商提供的安全补丁以修复该漏洞： http://www.bbraun.co.in/cps/rde/xchg/cw-bbraun-hi-in/hs.xsl/products.html?prid=PRID00001838

Reference

http://www.securityfocus.com/bid/98624

Impacted products

Name
B. Braun SpaceCom module 0

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "98624"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-6018",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6018"
    }
  },
  "description": "B. Braun SpaceCom Module \u662f\u4e00\u6b3e\u7528\u4e8e\u4fc3\u8fdb\u533b\u7597\u7cfb\u7edf\u4fe1\u606f\u4ea4\u6d41\u7684\u4ea7\u54c1\uff0c\u7528\u4e8e\u8fde\u63a5\u533b\u9662\u7f51\u7edc\u7cfb\u7edf\u548c\u5916\u90e8\u4e34\u5e8a\u7cfb\u7edf\uff0c\u5411\u5df2\u8fde\u63a5\u7684\u5de5\u4f5c\u7ad9\u8f93\u5165\u6570\u636e\u3001\u533b\u7597\u5386\u53f2\u548c\u670d\u52a1\u4fe1\u606f\u7b49\u3002\r\n\r\nB. Braun SpaceCom module\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u80fd\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u5e03\u4e00\u4e2a\u7279\u5236\u7684URI\u5e76\u8bf1\u5bfc\u7528\u6237\u70b9\u51fb\uff0c\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u7f51\u7ad9\uff0c\u9020\u6210\u9493\u9c7c\u653b\u51fb\u3002",
  "discovererName": "Marc Ruef and Rocco Gagliardi of scip AG.",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttp://www.bbraun.co.in/cps/rde/xchg/cw-bbraun-hi-in/hs.xsl/products.html?prid=PRID00001838",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-10575",
  "openTime": "2017-06-22",
  "patchDescription": "B. Braun SpaceCom Module \u662f\u4e00\u6b3e\u7528\u4e8e\u4fc3\u8fdb\u533b\u7597\u7cfb\u7edf\u4fe1\u606f\u4ea4\u6d41\u7684\u4ea7\u54c1\uff0c\u7528\u4e8e\u8fde\u63a5\u533b\u9662\u7f51\u7edc\u7cfb\u7edf\u548c\u5916\u90e8\u4e34\u5e8a\u7cfb\u7edf\uff0c\u5411\u5df2\u8fde\u63a5\u7684\u5de5\u4f5c\u7ad9\u8f93\u6ce8\u6570\u636e\u3001\u533b\u7597\u5386\u53f2\u548c\u670d\u52a1\u4fe1\u606f\u7b49\u3002\r\n\r\nB. Braun SpaceCom module\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u6ca1\u6709\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u5e03\u4e00\u4e2a\u7279\u5236\u7684URI\u5e76\u8bf1\u5bfc\u7528\u6237\u70b9\u51fb\uff0c\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u7f51\u7ad9\uff0c\u9020\u6210\u9493\u9c7c\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "B. Braun SpaceCom Module\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "B. Braun SpaceCom module 0"
  },
  "referenceLink": "http://www.securityfocus.com/bid/98624",
  "serverity": "\u4e2d",
  "submitTime": "2017-05-24",
  "title": "B. Braun SpaceCom Module\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2017-6018 (GCVE-0-2017-6018)

Vulnerability from cvelistv5 – Published: 2017-06-30 02:35 – Updated: 2024-08-05 15:18

Summary

An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input.

Severity

No CVSS data available.

CWE

CWE-601

Assigner

icscert icscert root

References

1 reference

URL	Tags
https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	B. Braun Medical SpaceCom	Affected: B. Braun Medical SpaceCom

Date Public

2017-06-29 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:18:49.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "B. Braun Medical SpaceCom",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "B. Braun Medical SpaceCom"
            }
          ]
        }
      ],
      "datePublic": "2017-06-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T02:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-6018",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "B. Braun Medical SpaceCom",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "B. Braun Medical SpaceCom"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2017-6018",
    "datePublished": "2017-06-30T02:35:00.000Z",
    "dateReserved": "2017-02-16T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:18:49.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-10575

CVE-2017-6018 (GCVE-0-2017-6018)

Tags

Sightings

Nomenclature

Related by attack behaviour