cvelistv5 - cve-2018-6690

CVE-2018-6690 (GCVE-0-2018-6690)

Vulnerability from cvelistv5

Published

2018-09-18 22:00

Modified

2024-08-05 06:10

Severity ?

6.1 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE

Whitelist bypass

Summary

Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.

References

URL

	Vendor	Product	Version
	McAfee	McAfee Application Control (MAC)	Version: 8.0.0 HF 4 <

icsa-18-345-01

Vulnerability from csaf_cisa

Published

2018-12-11 00:00

Modified

2018-12-11 00:00

Summary

ICSA-18-345-01 McAfee SINAMICS PERFECT HARMONY GH180

Notes

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Advisory Conversion Disclaimer

This CISA CSAF advisory was converted from Siemens ProductCERT's TXT advisory.

Critical infrastructure sectors

Multiple

Countries/areas deployed

Worldwide

Company headquarters location

Germany

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Recommended Practices

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Recommended Practices

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Recommended Practices

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

General Recommendations

As a general security measure, Siemens strongly recommends to protectnetwork access to devices with appropriate mechanisms. In order tooperate the devices in a protected IT environment, Siemens recommends toconfigure the environment according to Siemens' operational guidelinesfor Industrial Security (Download:https://www.siemens.com/cert/operational-guidelines-industrial-security),and to follow the recommendations in the product manuals.

General Recommendations

Additional information on Industrial Security by Siemens can be foundat: https://www.siemens.com/industrialsecurity

Siemens Security Advisories are subject to the terms and conditions containedin Siemens' underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter "License Terms"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens' Global Website(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens",
        "summary": "reported this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s TXT advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protectnetwork access to devices with appropriate mechanisms. In order tooperate the devices in a protected IT environment, Siemens recommends toconfigure the environment according to Siemens\u0027 operational guidelinesfor Industrial Security (Download:https://www.siemens.com/cert/operational-guidelines-industrial-security),and to follow the recommendations in the product manuals.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "Additional information on Industrial Security by Siemens can be foundat: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions containedin Siemens\u0027 underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter \"License Terms\"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website(https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-674165: Vulnerability in McAfee MACC product for SINAMICS PERFECT HARMONY GH180drives",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-674165.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-345-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/OT/white/2018/icsa-18-345-01.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-18-345-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-345-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICSA-18-345-01 McAfee SINAMICS PERFECT HARMONY GH180",
    "tracking": {
      "current_release_date": "2018-12-11T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-18-345-01",
      "initial_release_date": "2018-12-11T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2018-12-11T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR32 with option A30 (HMIs 12 inch or larger)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR32 with option A30 (HMIs 12 inch or larger)",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR42 with option A30 (HMIs 12 inch or larger)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR42 with option A30 (HMIs 12 inch or larger)",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR52 with option A30 (HMIs 12 inch or larger)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR52 with option A30 (HMIs 12 inch or larger)",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR325 (High Availability)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR325 (High Availability)",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR32 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR32 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR42 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XPP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR42 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XPP",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR52 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR52 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR325 (High Availability) where the HMI is operating under Microsoft Windows XP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR325 (High Availability) where the HMI is operating under Microsoft Windows XP",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-6690",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The executable files from a hard drive solidified by MACC, of an external system, can be executed on the system that did not generate the inventory.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6690"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR32..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR42..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR52..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR325..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. (High Availability) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR32..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0005"
          ]
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR42..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR52..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0007"
          ]
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR325..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. (High Availability) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk:connecting to the drive Protect local access to the drive",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk:connecting to the drive Ensure USB based storage media is blank and malware free before",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk:connecting to the drive Apply cell protection concept and implement Defense-in-Depth",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    }
  ]
}

ICSA-18-345-01

Vulnerability from csaf_cisa

Published

2018-12-11 00:00

Modified

2018-12-11 00:00

Summary

ICSA-18-345-01 McAfee SINAMICS PERFECT HARMONY GH180

Notes

Legal Notice

Advisory Conversion Disclaimer

This CISA CSAF advisory was converted from Siemens ProductCERT's TXT advisory.

Critical infrastructure sectors

Multiple

Countries/areas deployed

Worldwide

Company headquarters location

Germany

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Recommended Practices

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Recommended Practices

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

General Recommendations

Additional information on Industrial Security by Siemens can be foundat: https://www.siemens.com/industrialsecurity

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens",
        "summary": "reported this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s TXT advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protectnetwork access to devices with appropriate mechanisms. In order tooperate the devices in a protected IT environment, Siemens recommends toconfigure the environment according to Siemens\u0027 operational guidelinesfor Industrial Security (Download:https://www.siemens.com/cert/operational-guidelines-industrial-security),and to follow the recommendations in the product manuals.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "Additional information on Industrial Security by Siemens can be foundat: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions containedin Siemens\u0027 underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter \"License Terms\"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website(https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-674165: Vulnerability in McAfee MACC product for SINAMICS PERFECT HARMONY GH180drives",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-674165.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-345-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/OT/white/2018/icsa-18-345-01.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-18-345-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-345-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICSA-18-345-01 McAfee SINAMICS PERFECT HARMONY GH180",
    "tracking": {
      "current_release_date": "2018-12-11T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-18-345-01",
      "initial_release_date": "2018-12-11T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2018-12-11T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR32 with option A30 (HMIs 12 inch or larger)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR32 with option A30 (HMIs 12 inch or larger)",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR42 with option A30 (HMIs 12 inch or larger)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR42 with option A30 (HMIs 12 inch or larger)",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR52 with option A30 (HMIs 12 inch or larger)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR52 with option A30 (HMIs 12 inch or larger)",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR325 (High Availability)",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR325 (High Availability)",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR32 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR32 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR42 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XPP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR42 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XPP",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR52 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR52 with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MLFB 6SR325 (High Availability) where the HMI is operating under Microsoft Windows XP",
                "product": {
                  "name": "SINAMICS PERFECT HARMONY GH180 Drives: MLFB 6SR325 (High Availability) where the HMI is operating under Microsoft Windows XP",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "SINAMICS PERFECT HARMONY GH180 Drives"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-6690",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The executable files from a hard drive solidified by MACC, of an external system, can be executed on the system that did not generate the inventory.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6690"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR32..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR42..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR52..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "vendor_fix",
          "details": "MLFB 6SR325..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. (High Availability) Upgrade to MACC V8.2.0 or greater using recommendations from McAfee - Download: https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://kc.mcafee.com/corporate/index"
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR32..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0005"
          ]
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR42..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR52..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. with option A30 (HMIs 12 inch or larger) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0007"
          ]
        },
        {
          "category": "mitigation",
          "details": "MLFB 6SR325..-\u00ef\u00bf\u00bd..-\u00ef\u00bf\u00bd. (High Availability) where the HMI is operating under Microsoft Windows XP See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk:connecting to the drive Protect local access to the drive",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk:connecting to the drive Ensure USB based storage media is blank and malware free before",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk:connecting to the drive Apply cell protection concept and implement Defense-in-Depth",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    }
  ]
}

gsd-2018-6690

Vulnerability from gsd

Modified

2023-12-13 01:22

Details

Aliases

CVE-2018-6690

Aliases

CVE-2018-6690

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-6690",
    "description": "Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.",
    "id": "GSD-2018-6690"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-6690"
      ],
      "details": "Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.",
      "id": "GSD-2018-6690",
      "modified": "2023-12-13T01:22:35.770156Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@mcafee.com",
        "ID": "CVE-2018-6690",
        "STATE": "PUBLIC",
        "TITLE": "McAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "McAfee Application Control (MAC)",
                    "version": {
                      "version_data": [
                        {
                          "affected": "\u003c=",
                          "platform": "x86",
                          "version_name": "8.0.0 HF 4",
                          "version_value": "8.0.0 HF 4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "McAfee"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "McAfee credits Paul W for reporting this flaw."
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.0"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Whitelist bypass"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf",
            "refsource": "CONFIRM",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf"
          },
          {
            "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
            "refsource": "CONFIRM",
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250"
          }
        ]
      },
      "source": {
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:mcafee:application_change_control:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "7.0.2",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix1:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix2:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix3:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix4:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:mcafee:application_change_control:8.0.0:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@mcafee.com",
          "ID": "CVE-2018-6690"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-346"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2023-01-27T18:57Z",
      "publishedDate": "2018-09-18T22:29Z"
    }
  }
}

fkie_cve-2018-6690

Vulnerability from fkie_nvd

Published

2018-09-18 22:29

Modified

2024-11-21 04:11

Severity ?

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	trellixpsirt@trellix.com	https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf
	trellixpsirt@trellix.com	https://kc.mcafee.com/corporate/index?page=content&id=SB10250
	af854a3a-2127-422b-91ae-364da2661108	https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf
	af854a3a-2127-422b-91ae-364da2661108	https://kc.mcafee.com/corporate/index?page=content&id=SB10250

Impacted products

Vendor	Product	Version
mcafee	application_change_control	*
mcafee	application_change_control	8.0.0
mcafee	application_change_control	8.0.0
mcafee	application_change_control	8.0.0
mcafee	application_change_control	8.0.0
mcafee	application_change_control	8.0.0
microsoft	windows	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:application_change_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFB4AAA8-1FEA-4648-8D23-86ACA1865AE0",
              "versionEndIncluding": "7.0.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:application_change_control:8.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "F49B3D91-C415-4475-AB0C-C8616EA1D618",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix1:*:*:*:*:*:*",
              "matchCriteriaId": "F7855EC9-B8F2-4155-9801-5AE40CBC6F73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix2:*:*:*:*:*:*",
              "matchCriteriaId": "4F98D1F8-5EE8-43FB-A5D9-189D6C85D37E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix3:*:*:*:*:*:*",
              "matchCriteriaId": "841EFE70-EEA2-41C2-B131-74EFA6F27E11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:application_change_control:8.0.0:hotfix4:*:*:*:*:*:*",
              "matchCriteriaId": "93402938-F29F-44D4-BBC5-0A25A363AB3C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de acceso, modificaci\u00f3n o ejecuci\u00f3n de archivos ejecutables en el cliente Microsoft Windows en McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 y anteriores permite que usuarios autenticados ejecuten c\u00f3digo arbitrario mediante la transferencia de archivos del sistema externo."
    }
  ],
  "id": "CVE-2018-6690",
  "lastModified": "2024-11-21T04:11:06.593",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 3.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2,
        "source": "trellixpsirt@trellix.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-09-18T22:29:00.413",
  "references": [
    {
      "source": "trellixpsirt@trellix.com",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf"
    },
    {
      "source": "trellixpsirt@trellix.com",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250"
    }
  ],
  "sourceIdentifier": "trellixpsirt@trellix.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

cnvd-2018-25414

Vulnerability from cnvd

Title

McAfee Application and Change Control (MACC)任意代码执行漏洞

Description

McAfee Application and Change Control (MACC)是美国迈克菲（McAfee）公司的一套程序管控软件。该软件通过使用动态的信任模型，保护企业的服务器和终端免受未经授权应用程序和恶意软件的威胁。 McAfee Application and Change Control (MACC)存在任意代码执行漏洞。经过身份验证的攻击者可通过外部系统的文件传输，利用此漏洞执行任意代码。

Severity

中

Patch Name

McAfee Application and Change Control (MACC)任意代码执行漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://kc.mcafee.com/corporate/index?page=content&id=SB10250

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-6690

Impacted products

Name
McAfee McAfee Application and Change Control (MACC) <=8.0.0 Hotfix 4

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-6690",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6690"
    }
  },
  "description": "McAfee Application and Change Control (MACC)\u662f\u7f8e\u56fd\u8fc8\u514b\u83f2\uff08McAfee\uff09\u516c\u53f8\u7684\u4e00\u5957\u7a0b\u5e8f\u7ba1\u63a7\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u901a\u8fc7\u4f7f\u7528\u52a8\u6001\u7684\u4fe1\u4efb\u6a21\u578b\uff0c\u4fdd\u62a4\u4f01\u4e1a\u7684\u670d\u52a1\u5668\u548c\u7ec8\u7aef\u514d\u53d7\u672a\u7ecf\u6388\u6743\u5e94\u7528\u7a0b\u5e8f\u548c\u6076\u610f\u8f6f\u4ef6\u7684\u5a01\u80c1\u3002\n\nMcAfee Application and Change Control (MACC)\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5916\u90e8\u7cfb\u7edf\u7684\u6587\u4ef6\u4f20\u8f93\uff0c\u5229\u7528\u6b64\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "unknwon",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-25414",
  "openTime": "2018-12-14",
  "patchDescription": "McAfee Application and Change Control (MACC)\u662f\u7f8e\u56fd\u8fc8\u514b\u83f2\uff08McAfee\uff09\u516c\u53f8\u7684\u4e00\u5957\u7a0b\u5e8f\u7ba1\u63a7\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u901a\u8fc7\u4f7f\u7528\u52a8\u6001\u7684\u4fe1\u4efb\u6a21\u578b\uff0c\u4fdd\u62a4\u4f01\u4e1a\u7684\u670d\u52a1\u5668\u548c\u7ec8\u7aef\u514d\u53d7\u672a\u7ecf\u6388\u6743\u5e94\u7528\u7a0b\u5e8f\u548c\u6076\u610f\u8f6f\u4ef6\u7684\u5a01\u80c1\u3002\r\n\r\nMcAfee Application and Change Control (MACC)\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5916\u90e8\u7cfb\u7edf\u7684\u6587\u4ef6\u4f20\u8f93\uff0c\u5229\u7528\u6b64\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "McAfee Application and Change Control (MACC)\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "McAfee McAfee Application and Change Control (MACC) \u003c=8.0.0 Hotfix 4"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-6690",
  "serverity": "\u4e2d",
  "submitTime": "2018-09-20",
  "title": "McAfee Application and Change Control (MACC)\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CERTFR-2018-AVI-590

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	SINAMICS PERFECT HARMONY GH180 Drives avec MACC antérieures à V8.2.0
Siemens	N/A	SINUMERIK 840D sl versions 4.8 antérieures à V4.8 SP3
Siemens	N/A	SINUMERIK 840D sl versions 4.7 antérieures à V4.7 SP6 HF5
Siemens	N/A	TIM 1531 IRC versions antérieures à V2.0
Siemens	N/A	SINUMERIK 828D versions antérieures à V4.7 SP6 HF1

References

Title

Publication Time

ghsa-f6mq-9vj5-5r82

Vulnerability from github

Published

2022-05-13 01:31

Modified

2022-05-13 01:31

Severity ?

7.1 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-6690"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-18T22:29:00Z",
    "severity": "HIGH"
  },
  "details": "Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.",
  "id": "GHSA-f6mq-9vj5-5r82",
  "modified": "2022-05-13T01:31:56Z",
  "published": "2022-05-13T01:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6690"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-674165.pdf"
    },
    {
      "type": "WEB",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10250"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2018-6690 (GCVE-0-2018-6690)

Vulnerability from cvelistv5

icsa-18-345-01

Vulnerability from csaf_cisa

ICSA-18-345-01

Vulnerability from csaf_cisa

gsd-2018-6690

Vulnerability from gsd

fkie_cve-2018-6690

Vulnerability from fkie_nvd

cnvd-2018-25414

Vulnerability from cnvd

CERTFR-2018-AVI-590

Vulnerability from certfr_avis

Solution

ghsa-f6mq-9vj5-5r82

Vulnerability from github

Tags

Sightings

Nomenclature