PT-2013-1037 · Siemens · Simatic Wincc

Aleksandr Tlyapov · Publicado 2013-03-19 · Atualizado 2014-07-25 · CVE-2014-4685

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions prior to 7.3

Description The issue allows a local user to gain limited elevated privileges of the operating system user by leveraging weak system-object access control. This could potentially be exploited to gain increased access to system resources.

Recommendations For Siemens SIMATIC WinCC versions prior to 7.3, update to version 7.3 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2014-00408

CVE-2014-4685

Produtos afetados

Simatic Wincc

Referências · 9

• http://osvdb.org/show/osvdb/109482 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-4685 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00408 · Nota de Segurança
• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf · Aviso do Fabricante
• http://secunia.com/advisories/60392 · Nota
• http://securityfocus.com/bid/68872 · Nota
• http://ics-cert.us-cert.gov//advisories/ICSA-14-205-02%20http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf%20http://securitylab.ru/lab/PT-2014-15 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4685 · Nota de Segurança
• http://secunia.com/advisories/60388 · Nota