PT-2013-1459 · Siemens · Siemens Wincc

Publicado 2013-03-21 · Atualizado 2013-05-31 · CVE-2011-4515

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siemens WinCC (TIA Portal) version 11

Description The issue allows local users to obtain sensitive information by leveraging physical access or Sm@rt Server access, due to the use of a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files.

Recommendations For version 11, consider restricting access to the world-readable and world-writable files to minimize the risk of exploitation. As a temporary workaround, limit physical access and Sm@rt Server access to the system until a more secure password storage mechanism is implemented.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2011-4515

Produtos afetados

Siemens Wincc

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-4515 · Nota de Segurança
• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf · Aviso do Fabricante
• http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf · Nota