Stack-based buffer overflow in Siemens products - CVE-2017-11496

Vulnerability identifier: #VU10111

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11496

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow. A remote attacker can send malformed ASN1 streams in V2C and similar input files, trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

SIMATIC WinCC Add-On SIPAPER IT MIS
SIMATIC WinCC Add-On SICEMENT IT MIS
SIMATIC WinCC Add-On PM-QUALITY
SIMATIC WinCC Add-On PM-OPEN TCP/IP
SIMATIC WinCC Add-On PM-OPEN PV02
SIMATIC WinCC Add-On PM-OPEN PI
SIMATIC WinCC Add-On PM-OPEN IMPORT
SIMATIC WinCC Add-On PM-OPEN HOST-S
SIMATIC WinCC Add-On PM-OPEN EXPORT
SIMATIC WinCC Add-On PM-MAINT
SIMATIC WinCC Add-On PM-CONTROL
SIMATIC WinCC Add-On PM-ANALYZE
SIMATIC WinCC Add-On PM-AGENT
SIMATIC WinCC Add-On PI CONNECT AUDIT TRAIL
SIMATIC WinCC Add-On PI CONNECT ALARM
SIMATIC WinCC Add-On Historian CONNECT ALARM
License Management System
Desigo ABT
Annual Shading
Siveillance Identity
SiteIQ Analytics
Desigo XWP
Desigo Configuration Manager
Sentinel License Manager

Install update from vendor's website.

• https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-127490.pdf

• Multiple vulnerabilities in Siemens SIMATIC WinCC Add-Ons
• Multiple vulnerabilities in Gemalto Sentinel License Manager
• Multiple vulnerabilities in Siemens Building Technologies Products