PT-2013-3952 · Catapult+1 · Catapult Dnp3 I/O Driver+4

Publicado 2013-11-22 · Atualizado 2013-11-22 · CVE-2013-2823

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Catapult DNP3 I/O driver versions prior to 7.2.0.60 GE Intelligent Platforms Proficy DNP3 I/O driver versions prior to 7.20k

Description The issue allows physically proximate attackers to cause a denial of service, resulting in an infinite loop, via crafted input over a serial line. This is related to the DNPDrv.exe, also known as the DNP master station server, used in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX.

Recommendations For Catapult DNP3 I/O driver versions prior to 7.2.0.60, update to version 7.2.0.60 or later. For GE Intelligent Platforms Proficy DNP3 I/O driver versions prior to 7.20k, update to version 7.20k or later.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-2823

Produtos afetados

Catapult Dnp3 I/O Driver

Dnpdrv.Exe

Ge Intelligent Platforms Proficy Dnp3 I/O Driver

Proficy Hmi/Scada - Cimplicity

Ifix

Referências · 6

• http://ics-cert.us-cert.gov/advisories/ICSA-13-297-01 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2823 · Nota
• http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15805 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2823 · Nota de Segurança
• http://ics-cert.us-cert.gov/advisories/ICSA-13-297-02 · Nota
• http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/15000/KB15805/en_US/GEIP13-04%20Security%20Advisory%20-%20Proficy%20HMI%20SCADA%20DNP3%20Driver%20from%20Catapult%20Software.pdf · Aviso do Fabricante