cnvd - cnvd-2019-01681

cnvd-2019-01681

Vulnerability from cnvd

Title: Emerson DeltaV Distributed Control System身份验证绕过漏洞

Description:

Emerson DeltaV Distributed Control System是美国艾默生电气（Emerson Electric）公司的一套自动化分布式控制系统。该系统包括网络安全管理、报警管理、批量控制和变更管理等功能。

Emerson DeltaV Distributed Control System中存在身份验证绕过漏洞，远程攻击者可利用该漏洞绕过身份验证机制并造成拒绝服务。

Severity: 中

Patch Name: Emerson DeltaV Distributed Control System身份验证绕过漏洞的补丁

Patch Description:

Emerson DeltaV Distributed Control System中存在身份验证绕过漏洞，远程攻击者可利用该漏洞绕过身份验证机制并造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.emerson.com/

Reference: http://www.securityfocus.com/bid/106522

Impacted products

Name
['Emerson Electric DeltaV Distributed Control System 11.3.1', 'Emerson Electric DeltaV Distributed Control System 11.3.2', 'Emerson Electric DeltaV Distributed Control System 12.3.1', 'Emerson Electric DeltaV Distributed Control System 13.3.1', 'Emerson Electric DeltaV Distributed Control System 14.3', 'Emerson Electric DeltaV Distributed Control System R5.1', 'Emerson Electric DeltaV Distributed Control System <=R6']

Name

['Emerson Electric DeltaV Distributed Control System 11.3.1', 'Emerson Electric DeltaV Distributed Control System 11.3.2', 'Emerson Electric DeltaV Distributed Control System 12.3.1', 'Emerson Electric DeltaV Distributed Control System 13.3.1', 'Emerson Electric DeltaV Distributed Control System 14.3', 'Emerson Electric DeltaV Distributed Control System R5.1', 'Emerson Electric DeltaV Distributed Control System <=R6']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "106522"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-19021"
    }
  },
  "description": "Emerson DeltaV Distributed Control System\u662f\u7f8e\u56fd\u827e\u9ed8\u751f\u7535\u6c14\uff08Emerson Electric\uff09\u516c\u53f8\u7684\u4e00\u5957\u81ea\u52a8\u5316\u5206\u5e03\u5f0f\u63a7\u5236\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u62ec\u7f51\u7edc\u5b89\u5168\u7ba1\u7406\u3001\u62a5\u8b66\u7ba1\u7406\u3001\u6279\u91cf\u63a7\u5236\u548c\u53d8\u66f4\u7ba1\u7406\u7b49\u529f\u80fd\u3002\n\nEmerson DeltaV Distributed Control System\u4e2d\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\u5e76\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Alexander Nochvay",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.emerson.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-01681",
  "openTime": "2019-01-16",
  "patchDescription": "Emerson DeltaV Distributed Control System\u662f\u7f8e\u56fd\u827e\u9ed8\u751f\u7535\u6c14\uff08Emerson Electric\uff09\u516c\u53f8\u7684\u4e00\u5957\u81ea\u52a8\u5316\u5206\u5e03\u5f0f\u63a7\u5236\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u62ec\u7f51\u7edc\u5b89\u5168\u7ba1\u7406\u3001\u62a5\u8b66\u7ba1\u7406\u3001\u6279\u91cf\u63a7\u5236\u548c\u53d8\u66f4\u7ba1\u7406\u7b49\u529f\u80fd\u3002\r\n\r\nEmerson DeltaV Distributed Control System\u4e2d\u5b58\u5728\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\u5e76\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Emerson DeltaV Distributed Control System\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Emerson Electric DeltaV Distributed Control System 11.3.1",
      "Emerson Electric DeltaV Distributed Control System 11.3.2",
      "Emerson Electric DeltaV Distributed Control System 12.3.1",
      "Emerson Electric DeltaV Distributed Control System 13.3.1",
      "Emerson Electric DeltaV Distributed Control System 14.3",
      "Emerson Electric DeltaV Distributed Control System R5.1",
      "Emerson Electric DeltaV Distributed Control System \u003c=R6"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/106522",
  "serverity": "\u4e2d",
  "submitTime": "2019-01-15",
  "title": "Emerson DeltaV Distributed Control System\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2018-19021 (GCVE-0-2018-19021)

Vulnerability from cvelistv5

Published

2019-01-25 20:00

Modified

2024-09-17 03:52

Severity ?

CWE

CWE-307 - Authentication Bypass

Summary

A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/106522	vdb-entry, x_refsource_BID
	https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Emerson	Emerson DeltaV	Version: DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:23:08.523Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106522",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106522"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Emerson DeltaV",
          "vendor": "Emerson",
          "versions": [
            {
              "status": "affected",
              "version": "DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior."
            }
          ]
        }
      ],
      "datePublic": "2019-01-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Authentication Bypass CWE-307",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-26T10:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "106522",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106522"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2019-01-10T00:00:00",
          "ID": "CVE-2018-19021",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Emerson DeltaV",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Emerson"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Authentication Bypass CWE-307"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106522",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106522"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-19021",
    "datePublished": "2019-01-25T20:00:00Z",
    "dateReserved": "2018-11-06T00:00:00",
    "dateUpdated": "2024-09-17T03:52:35.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted