cnvd - cnvd-2018-25420

cnvd-2018-25420

Vulnerability from cnvd

Title: 多款Siemens产品缓冲区溢出漏洞

Description:

Siemens SINUMERIK 808D等都是德国西门子（Siemens）公司的数控机床系统控制器。

多款Siemens产品中存在基于栈的缓冲区溢出漏洞。本地攻击者可利用该漏洞以提升的权限执行代码，影响系统的保密性、完整性和可用性。

Severity: 高

Patch Name: 多款Siemens产品缓冲区溢出漏洞的补丁

Patch Description:

Siemens SINUMERIK 808D等都是德国西门子（Siemens）公司的数控机床系统控制器。

多款Siemens产品中存在基于栈的缓冲区溢出漏洞。本地攻击者可利用该漏洞以提升的权限执行代码，影响系统的保密性、完整性和可用性。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商只发布了产品828D、840D的升级补丁以修复漏洞，产品808D的升级补丁暂未发布，详情请参考链接： https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

Reference: https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

Impacted products

Name
['SIEMENS SINUMERIK 808D V4.7', 'SIEMENS SINUMERIK 808D V4.8', 'SIEMENS SINUMERIK 840D < V4.7 SP6 HF5', 'SIEMENS SINUMERIK 840D < V4.8 SP3', 'SIEMENS SINUMERIK 828D < V4.7 SP6 HF1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-11463"
    }
  },
  "description": "Siemens SINUMERIK 808D\u7b49\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u6570\u63a7\u673a\u5e8a\u7cfb\u7edf\u63a7\u5236\u5668\u3002\n\n\u591a\u6b3eSiemens\u4ea7\u54c1\u4e2d\u5b58\u5728\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u63d0\u5347\u7684\u6743\u9650\u6267\u884c\u4ee3\u7801\uff0c\u5f71\u54cd\u7cfb\u7edf\u7684\u4fdd\u5bc6\u6027\u3001\u5b8c\u6574\u6027\u548c\u53ef\u7528\u6027\u3002",
  "discovererName": "SIEMENS",
  "formalWay": "\u76ee\u524d\u5382\u5546\u53ea\u53d1\u5e03\u4e86\u4ea7\u54c1828D\u3001840D\u7684\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u4ea7\u54c1808D\u7684\u5347\u7ea7\u8865\u4e01\u6682\u672a\u53d1\u5e03\uff0c\u8be6\u60c5\u8bf7\u53c2\u8003\u94fe\u63a5\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-25420",
  "openTime": "2018-12-14",
  "patchDescription": "Siemens SINUMERIK 808D\u7b49\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u6570\u63a7\u673a\u5e8a\u7cfb\u7edf\u63a7\u5236\u5668\u3002\r\n\r\n\u591a\u6b3eSiemens\u4ea7\u54c1\u4e2d\u5b58\u5728\u57fa\u4e8e\u6808\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u63d0\u5347\u7684\u6743\u9650\u6267\u884c\u4ee3\u7801\uff0c\u5f71\u54cd\u7cfb\u7edf\u7684\u4fdd\u5bc6\u6027\u3001\u5b8c\u6574\u6027\u548c\u53ef\u7528\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eSiemens\u4ea7\u54c1\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SIEMENS SINUMERIK 808D V4.7",
      "SIEMENS SINUMERIK 808D V4.8",
      "SIEMENS SINUMERIK 840D \u003c V4.7 SP6 HF5",
      "SIEMENS SINUMERIK 840D \u003c V4.8 SP3",
      "SIEMENS SINUMERIK 828D \u003c V4.7 SP6 HF1"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2018-12-14",
  "title": "\u591a\u6b3eSiemens\u4ea7\u54c1\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2018-11463 (GCVE-0-2018-11463)

Vulnerability from cvelistv5

Published

2018-12-12 16:00

Modified

2024-08-05 08:10

Severity ?

CWE

CWE-121 - Stack-based Buffer Overflow

Summary

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A buffer overflow in the service command application could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/106185	vdb-entry, x_refsource_BID
	https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Siemens AG	SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8	Version: SINUMERIK 808D V4.7 : All versions Version: SINUMERIK 808D V4.8 : All versions Version: SINUMERIK 828D V4.7 : All versions < V4.7 SP6 HF1 Version: SINUMERIK 840D sl V4.7 : All versions < V4.7 SP6 HF5 Version: SINUMERIK 840D sl V4.8 : All versions < V4.8 SP3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:10:14.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106185",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106185"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "SINUMERIK 808D V4.7 : All versions"
            },
            {
              "status": "affected",
              "version": "SINUMERIK 808D V4.8 : All versions"
            },
            {
              "status": "affected",
              "version": "SINUMERIK 828D V4.7 : All versions \u003c V4.7 SP6 HF1"
            },
            {
              "status": "affected",
              "version": "SINUMERIK 840D sl V4.7 : All versions \u003c V4.7 SP6 HF5"
            },
            {
              "status": "affected",
              "version": "SINUMERIK 840D sl V4.8 : All versions \u003c V4.8 SP3"
            }
          ]
        }
      ],
      "datePublic": "2018-12-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions \u003c V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \u003c V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions \u003c V4.8 SP3). A buffer overflow in the service command application could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-14T10:57:02",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "name": "106185",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106185"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2018-11463",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "SINUMERIK 808D V4.7 : All versions"
                          },
                          {
                            "version_value": "SINUMERIK 808D V4.8 : All versions"
                          },
                          {
                            "version_value": "SINUMERIK 828D V4.7 : All versions \u003c V4.7 SP6 HF1"
                          },
                          {
                            "version_value": "SINUMERIK 840D sl V4.7 : All versions \u003c V4.7 SP6 HF5"
                          },
                          {
                            "version_value": "SINUMERIK 840D sl V4.8 : All versions \u003c V4.8 SP3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens AG"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions \u003c V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions \u003c V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions \u003c V4.8 SP3). A buffer overflow in the service command application could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-121: Stack-based Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106185",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106185"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2018-11463",
    "datePublished": "2018-12-12T16:00:00",
    "dateReserved": "2018-05-25T00:00:00",
    "dateUpdated": "2024-08-05T08:10:14.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted