PT-2017-12051 · Gemalto · Sentinel Ldk+2

Publicado 2017-10-02 · Atualizado 2018-05-11 · CVE-2017-11497

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gemalto ACC (Admin Control Center) versions HASP SRM 2.10 through Sentinel LDK 7.50

Description The issue is related to a stack buffer overflow in the hasplms component, which can be exploited by remote attackers to execute arbitrary code. This is achieved through language packs that contain filenames longer than 1024 characters.

Recommendations For versions HASP SRM 2.10 through Sentinel LDK 7.50, consider restricting access to language packs to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using language packs with filenames longer than 1024 characters.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-11497

Produtos afetados

Gemalto Acc

Hasp Srm

Sentinel Ldk

Referências · 9

• https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-002-sentinel-ldk-rte-language-packs-containing-malformed-filenames-lead-to-remote-code-execution · Nota
• https://iotvillage.org/slides_dc25/Sergey_Vlad_DEFCON_IOT_Village_Public2017.pptx · Nota
• http://securityfocus.com/bid/102739 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11497 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01 · Nota
• http://securityfocus.com/bid/102906 · Nota
• https://osv.dev/vulnerability/CVE-2017-11497 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01 · Nota