PT-2017-13205 · Automationdirect · Directsoft Programming+6

Publicado 2017-11-13 · Atualizado 2018-08-01 · CVE-2017-14020

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AutomationDirect CLICK Programming Software versions 2.10 and prior C-More Programming Software versions 6.30 and prior C-More Micro versions 4.20.01.0 and prior Do-more Designer Software versions 2.0.3 and prior GS Drives Configuration Software versions 4.0.6 and prior SL-SOFT SOLO Temperature Controller Configuration Software versions 1.1.0.5 and prior DirectSOFT Programming Software versions 6.1 and prior

Description An uncontrolled search path element vulnerability, also known as DLL Hijacking, has been identified. This issue allows an attacker to exploit the vulnerability by renaming a malicious DLL to match the application's requirements. The application fails to verify the authenticity of the DLL, which could then load and execute malicious code at the privilege level of the application.

Recommendations For AutomationDirect CLICK Programming Software versions 2.10 and prior, update to a version later than 2.10 to resolve the issue. For C-More Programming Software versions 6.30 and prior, update to a version later than 6.30 to resolve the issue. For C-More Micro versions 4.20.01.0 and prior, update to a version later than 4.20.01.0 to resolve the issue. For Do-more Designer Software versions 2.0.3 and prior, update to a version later than 2.0.3 to resolve the issue. For GS Drives Configuration Software versions 4.0.6 and prior, update to a version later than 4.0.6 to resolve the issue. For SL-SOFT SOLO Temperature Controller Configuration Software versions 1.1.0.5 and prior, update to a version later than 1.1.0.5 to resolve the issue. For DirectSOFT Programming Software versions 6.1 and prior, update to a version later than 6.1 to resolve the issue.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2017-14020

Produtos afetados

Automationdirect Click Programming

C-More Micro

C-More Programming

Directsoft Programming

Do-More Designer

Gs Drives Configuration

Sl-Soft Solo Temperature Controller Configuration

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-14020 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14020 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-313-01 · Nota
• http://securityfocus.com/bid/101780 · Nota