SB2014021401 - Remote code execution in GE Proficy CIMPLICITY HMI

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2014-0751)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper access control and incorrect validation of the szScreen field when processing file uploads within the CimWebServer component. A remote unauthenticated attacker can upload and execute arbitrary file on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability has been exploited in targeted attacks.

Remediation

Install update from vendor's website.

References

• https://ge-ip.force.com/communities/servlet/fileField?retURL=%2Fcommunities%2Fapex%2FKnowledgeDetail...
• http://www.zerodayinitiative.com/advisories/ZDI-14-016/
• https://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-281-01B