PT-2013-1037 · Siemens · Simatic Wincc

Aleksandr Tlyapov · Published 2013-03-19 · Updated 2014-07-25 · CVE-2014-4685

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions prior to 7.3

Description The issue allows a local user to gain limited elevated privileges of the operating system user by leveraging weak system-object access control. This could potentially be exploited to gain increased access to system resources.

Recommendations For Siemens SIMATIC WinCC versions prior to 7.3, update to version 7.3 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2014-00408

CVE-2014-4685

Affected Products

Simatic Wincc

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-4685 · Security Note
• https://bdu.fstec.ru/vul/2014-00408 · Security Note
• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4685 · Security Note
• http://osvdb.org/show/osvdb/109482 · Note
• http://secunia.com/advisories/60392 · Note
• http://securityfocus.com/bid/68872 · Note
• http://ics-cert.us-cert.gov//advisories/ICSA-14-205-02%20http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf%20http://securitylab.ru/lab/PT-2014-15 · Note
• http://secunia.com/advisories/60388 · Note