PT-2017-12051 · Gemalto · Sentinel Ldk+2

Published 2017-10-02 · Updated 2018-05-11 · CVE-2017-11497

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gemalto ACC (Admin Control Center) versions HASP SRM 2.10 through Sentinel LDK 7.50

Description The issue is related to a stack buffer overflow in the hasplms component, which can be exploited by remote attackers to execute arbitrary code. This is achieved through language packs that contain filenames longer than 1024 characters.

Recommendations For versions HASP SRM 2.10 through Sentinel LDK 7.50, consider restricting access to language packs to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using language packs with filenames longer than 1024 characters.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-11497

Affected Products

Gemalto Acc

Hasp Srm

Sentinel Ldk

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2017-11497 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11497 · Vendor Advisory
• https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-002-sentinel-ldk-rte-language-packs-containing-malformed-filenames-lead-to-remote-code-execution · Note
• https://iotvillage.org/slides_dc25/Sergey_Vlad_DEFCON_IOT_Village_Public2017.pptx · Note
• http://securityfocus.com/bid/102739 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01 · Note
• http://securityfocus.com/bid/102906 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01 · Note