cnvd - cnvd-2018-25432

cnvd-2018-25432

Vulnerability from cnvd

Title: Siemens SIMATIC Panels和SIMATIC WinCC代码注入漏洞

Description:

Siemens SIMATIC Panels和SIMATIC WinCC（TIA Portal）都是德国西门子（Siemens）公司的产品。Siemens SIMATIC Panels是一款人机界面面板。SIMATIC WinCC是一套自动化的数据采集与监控（SCADA）系统。

Siemens SIMATIC Panels和SIMATIC WinCC (TIA Portal)中存在代码注入漏洞，攻击者可借助恶意的链接利用该漏洞注入HTTP包头。

Severity: 中

Patch Name: Siemens SIMATIC Panels和SIMATIC WinCC代码注入漏洞的补丁

Patch Description:

Siemens SIMATIC Panels和SIMATIC WinCC (TIA Portal)中存在代码注入漏洞，攻击者可借助恶意的链接利用该漏洞注入HTTP包头。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商只发布了SIMATIC HMI Comfort Panels等产品的升级补丁以修复漏洞，产品SIMATIC HMI Classic Devices的升级补丁暂未发布，详情请参考链接： https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf

Reference: https://ics-cert.us-cert.gov/advisories/ICSA-18-317-03

Impacted products

Name
['Siemens SIMATIC HMI Comfort Panels 4" - 22" <14', 'Siemens SIMATIC HMI Comfort Outdoor Panels 7"和15" <14', 'Siemens SIMATIC HMI KTP Mobile Panels（KTP400F、KTP700、KTP700F、KTP900和KTP900F） <14', 'Siemens SIMATIC WinCC Runtime Advanced <14', 'Siemens SIMATIC WinCC Runtime Professional <14', 'Siemens SIMATIC WinCC (TIA Portal) <14']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-13814"
    }
  },
  "description": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\uff08TIA Portal\uff09\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Siemens SIMATIC Panels\u662f\u4e00\u6b3e\u4eba\u673a\u754c\u9762\u9762\u677f\u3002SIMATIC WinCC\u662f\u4e00\u5957\u81ea\u52a8\u5316\u7684\u6570\u636e\u91c7\u96c6\u4e0e\u76d1\u63a7\uff08SCADA\uff09\u7cfb\u7edf\u3002\n\nSiemens SIMATIC Panels\u548cSIMATIC WinCC (TIA Portal)\u4e2d\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165HTTP\u5305\u5934\u3002",
  "discovererName": "Siemens",
  "formalWay": "\u76ee\u524d\u5382\u5546\u53ea\u53d1\u5e03\u4e86SIMATIC HMI Comfort Panels\u7b49\u4ea7\u54c1\u7684\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u4ea7\u54c1SIMATIC HMI Classic Devices\u7684\u5347\u7ea7\u8865\u4e01\u6682\u672a\u53d1\u5e03\uff0c\u8be6\u60c5\u8bf7\u53c2\u8003\u94fe\u63a5\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-25432",
  "openTime": "2018-12-14",
  "patchDescription": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\uff08TIA Portal\uff09\u90fd\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Siemens SIMATIC Panels\u662f\u4e00\u6b3e\u4eba\u673a\u754c\u9762\u9762\u677f\u3002SIMATIC WinCC\u662f\u4e00\u5957\u81ea\u52a8\u5316\u7684\u6570\u636e\u91c7\u96c6\u4e0e\u76d1\u63a7\uff08SCADA\uff09\u7cfb\u7edf\u3002\r\n\r\nSiemens SIMATIC Panels\u548cSIMATIC WinCC (TIA Portal)\u4e2d\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165HTTP\u5305\u5934\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SIMATIC HMI Comfort Panels 4\" - 22\" \u003c14",
      "Siemens SIMATIC HMI Comfort Outdoor Panels 7\"\u548c15\" \u003c14",
      "Siemens SIMATIC HMI KTP Mobile Panels\uff08KTP400F\u3001KTP700\u3001KTP700F\u3001KTP900\u548cKTP900F\uff09 \u003c14",
      "Siemens SIMATIC WinCC Runtime Advanced \u003c14",
      "Siemens SIMATIC WinCC Runtime Professional \u003c14",
      "Siemens SIMATIC WinCC (TIA Portal) \u003c14"
    ]
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-18-317-03",
  "serverity": "\u4e2d",
  "submitTime": "2018-11-16",
  "title": "Siemens SIMATIC Panels\u548cSIMATIC WinCC\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2018-13814 (GCVE-0-2018-13814)

Vulnerability from cvelistv5

Published

2018-12-13 16:00

Modified

2024-08-05 09:14

Severity ?

CWE

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Summary

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V14), SIMATIC WinCC Runtime Advanced (All versions < V14), SIMATIC WinCC Runtime Professional (All versions < V14), SIMATIC WinCC (TIA Portal) (All versions < V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105931	vdb-entry, x_refsource_BID
	https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Siemens AG	SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)	Version: SIMATIC HMI Comfort Panels 4" - 22" : All versions < V14 Version: SIMATIC HMI Comfort Outdoor Panels 7" & 15" : All versions < V14 Version: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions < V14 Version: SIMATIC WinCC Runtime Advanced : All versions < V14 Version: SIMATIC WinCC Runtime Professional : All versions < V14 Version: SIMATIC WinCC (TIA Portal) : All versions < V14 Version: SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:14:47.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105931",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105931"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SIMATIC HMI Comfort Panels 4\" - 22\", SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "SIMATIC HMI Comfort Panels 4\" - 22\" : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC Runtime Advanced : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC Runtime Professional : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC WinCC (TIA Portal) : All versions \u003c V14"
            },
            {
              "status": "affected",
              "version": "SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions"
            }
          ]
        }
      ],
      "datePublic": "2018-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SIMATIC HMI Comfort Panels 4\" - 22\" (All versions \u003c V14), SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" (All versions \u003c V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions \u003c V14), SIMATIC WinCC Runtime Advanced (All versions \u003c V14), SIMATIC WinCC Runtime Professional (All versions \u003c V14), SIMATIC WinCC (TIA Portal) (All versions \u003c V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-14T10:57:02",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "name": "105931",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105931"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2018-13814",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SIMATIC HMI Comfort Panels 4\" - 22\", SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "SIMATIC HMI Comfort Panels 4\" - 22\" : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC WinCC Runtime Advanced : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC WinCC Runtime Professional : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC WinCC (TIA Portal) : All versions \u003c V14"
                          },
                          {
                            "version_value": "SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens AG"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SIMATIC HMI Comfort Panels 4\" - 22\" (All versions \u003c V14), SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" (All versions \u003c V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions \u003c V14), SIMATIC WinCC Runtime Advanced (All versions \u003c V14), SIMATIC WinCC Runtime Professional (All versions \u003c V14), SIMATIC WinCC (TIA Portal) (All versions \u003c V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105931",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105931"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2018-13814",
    "datePublished": "2018-12-13T16:00:00",
    "dateReserved": "2018-07-10T00:00:00",
    "dateUpdated": "2024-08-05T09:14:47.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted