SB2019070403 - Multiple vulnerabilities in Advantech WebAccess/SCADA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019070403

SB2019070403 - Multiple vulnerabilities in Advantech WebAccess/SCADA

Published: July 4, 2019 Updated: September 19, 2019

Security Bulletin ID SB2019070403
CSH Severity
High
Patch available
YES
Number of vulnerabilities 32
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 94% Medium 6%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 32 vulnerabilities.


1) Stack-based buffer overflow (CVE-ID: CVE-2019-10991)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within the 0x113cd IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.


2) Stack-based buffer overflow (CVE-ID: CVE-2019-10991)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within the 0x1138a IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.


3) Stack-based buffer overflow (CVE-ID: CVE-2019-10991)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within bwwebv.exe accessible through the 0x2711 IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.


4) Stack-based buffer overflow (CVE-ID: CVE-2019-10991)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within bwwebv.exe accessible through the 0x2711 IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.


5) Stack-based buffer overflow (CVE-ID: CVE-2019-10991)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within bwmail.exe accessible through the 0x2711 IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.


6) Stack-based buffer overflow (CVE-ID: CVE-2019-10991)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within bwclient.exe accessible through the 0x2711 IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.


7) Heap-based buffer overflow (CVE-ID: CVE-2019-10989)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within the 0x113d1 IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Out-of-bounds write (CVE-ID: CVE-2019-10987)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within the 0x2723 IOCTL. A remote attacker can send a specially crafted file to the affected application, trigger out-of-bounds write error and execute arbitrary code on the system.


9) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27E5 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

10) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27DA IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

11) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27E7 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

12) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x277D IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

13) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27DC IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

14) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x277F IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

15) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x277B IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

16) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27E4 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

17) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27EC IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

18) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x2776 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

19) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27DD IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

20) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27D9 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

21) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27DB IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

22) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x2780 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

23) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27E6 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

24) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27F4 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

25) Path traversal (CVE-ID: CVE-2019-10985)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to lack of proper validation of a user-supplied path prior to use in file operations when processing data passed to the webvrpcs process, within the 0x2715 IOCTL. A remote attacker can send a specially crafted HTTP request and delete arbitrary files on the system while posing as an administrator.


26) Stack-based buffer overflow (CVE-ID: CVE-2019-10991)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within the 0x271C IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.


27) Heap-based buffer overflow (CVE-ID: CVE-2019-10989)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within the 0x11372 IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


28) Out-of-bounds read (CVE-ID: CVE-2019-10983)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within viewsrv.dll accessible through the 0x2722 IOCTL. A remote attacker can send a specially crafted file to the affected application, trigger out-of-bounds read error and read contents of memory on the system.


29) Out-of-bounds write (CVE-ID: CVE-2019-10987)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within bwdraw.exe accessible through the 0x2711 IOCTL. A remote attacker can send a specially crafted file to the affected application, trigger out-of-bounds write error and execute arbitrary code on the system.


30) Untrusted Pointer Dereference (CVE-ID: CVE-2019-10993)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing data passed to the webvrpcs process, within the 0x27E9 IOCTL. A remote attacker can send a specially crafted request and execute arbitrary code on the targeted system.

31) Stack-based buffer overflow (CVE-ID: CVE-2019-3953)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in "viewsrv.dll" due to a boundary error when processing an IOCTL 10012 RPC call. A remote unauthenticated attacker can send a specially crafted IOCTL 10012 RPC message to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


32) Stack-based buffer overflow (CVE-ID: CVE-2019-3954)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists in the "VdBroadWinGetLocalDataLogEx()" function in "viewdll1.dll" due to a boundary error when processing an IOCTL 81024 RPC message. A remote unauthenticated attacker can send a specially crafted IOCTL 81024 RPC message to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References