PT-2016-3179 · Siemens · Siemens Sicam Pas

Dmitry Sklyarov + 1 · CVE-2016-5849 · Publicado 2016-01-15 · Atualizado 2023-10-17

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Baixa

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens SICAM PAS versions prior to 8.07

Description The issue is related to insufficient password protection in databases, which could allow a local attacker with certain database privileges to calculate passwords. Additionally, it may enable local users to obtain sensitive configuration information by leveraging database stoppage.

Recommendations For Siemens SICAM PAS versions prior to 8.07, consider restricting access to the database to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit privileges for local users to prevent them from obtaining sensitive configuration information.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2017-02204

CVE-2016-5849

Produtos afetados

Siemens Sicam Pas

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2016-5849 · Nota de Segurança
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-444217.pdf · Aviso do Fabricante
• http://securitylab.ru/lab/PT-2016-29 · Nota
• https://osv.dev/vulnerability/CVE-2016-5849 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02204 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5849%20https://ics-cert.us-cert.gov/advisories/ICSA-16-182-02 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-16-182-02 · Nota
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-444217.pdf%20http://securityfocus.com/bid/91525 · Nota
• http://securityfocus.com/bid/91525 · Nota