PT-2013-3951 · Novatech · Orion5/Orion5R Dnp Slave+3

Adam Crain + 1 · Publicado 2013-12-21 · Atualizado 2013-12-26 · CVE-2013-2822

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NovaTech Orion Substation Automation Platform OrionLX DNP Master versions 1.27.38 and earlier NovaTech Orion Substation Automation Platform OrionLX DNP Slave versions 1.23.10 and earlier NovaTech Orion5/Orion5r DNP Master versions 1.27.38 and earlier NovaTech Orion5/Orion5r DNP Slave versions 1.23.10 and earlier

Description The issue allows physically proximate attackers to cause a denial of service, resulting in a driver crash and process restart, via crafted input over a serial line.

Recommendations For NovaTech Orion Substation Automation Platform OrionLX DNP Master version 1.27.38 and earlier, update to a version that addresses the issue. For NovaTech Orion Substation Automation Platform OrionLX DNP Slave version 1.23.10 and earlier, update to a version that addresses the issue. For NovaTech Orion5/Orion5r DNP Master version 1.27.38 and earlier, update to a version that addresses the issue. For NovaTech Orion5/Orion5r DNP Slave version 1.23.10 and earlier, update to a version that addresses the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-2822

Produtos afetados

Orion5/Orion5R Dnp Master

Orion5/Orion5R Dnp Slave

Orionlx Dnp Master

Orionlx Dnp Slave

Referências · 2

• http://ics-cert.us-cert.gov/advisories/ICSA-13-352-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2822 · Nota de Segurança