PT-2018-10585 · Rockwell Automation · Automation License Manager

Publicado 2018-08-07 · Atualizado 2019-10-09 · CVE-2018-11456

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Automation License Manager 5 versions prior to 5.3.4.4

Description A vulnerability allows an attacker with network access to send specially crafted network packets to determine the accessibility of a network port on a remote system. This enables the attacker to perform basic network scanning using the victim's machine. Successful exploitation requires a network connection to the affected device and does not need privileges or user interaction. The impact is limited to determining port accessibility on a target system.

Recommendations For Automation License Manager 5 versions prior to 5.3.4.4, update to version 5.3.4.4 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2018-11456

Produtos afetados

Automation License Manager

Referências · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-920962.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11456 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11456 · Aviso do Fabricante
• http://securityfocus.com/bid/105114 · Nota