PT-2017-13205 · Automationdirect · Directsoft Programming+6

Published 2017-11-13 · Updated 2018-08-01 · CVE-2017-14020

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AutomationDirect CLICK Programming Software versions 2.10 and prior C-More Programming Software versions 6.30 and prior C-More Micro versions 4.20.01.0 and prior Do-more Designer Software versions 2.0.3 and prior GS Drives Configuration Software versions 4.0.6 and prior SL-SOFT SOLO Temperature Controller Configuration Software versions 1.1.0.5 and prior DirectSOFT Programming Software versions 6.1 and prior

Description An uncontrolled search path element vulnerability, also known as DLL Hijacking, has been identified. This issue allows an attacker to exploit the vulnerability by renaming a malicious DLL to match the application's requirements. The application fails to verify the authenticity of the DLL, which could then load and execute malicious code at the privilege level of the application.

Recommendations For AutomationDirect CLICK Programming Software versions 2.10 and prior, update to a version later than 2.10 to resolve the issue. For C-More Programming Software versions 6.30 and prior, update to a version later than 6.30 to resolve the issue. For C-More Micro versions 4.20.01.0 and prior, update to a version later than 4.20.01.0 to resolve the issue. For Do-more Designer Software versions 2.0.3 and prior, update to a version later than 2.0.3 to resolve the issue. For GS Drives Configuration Software versions 4.0.6 and prior, update to a version later than 4.0.6 to resolve the issue. For SL-SOFT SOLO Temperature Controller Configuration Software versions 1.1.0.5 and prior, update to a version later than 1.1.0.5 to resolve the issue. For DirectSOFT Programming Software versions 6.1 and prior, update to a version later than 6.1 to resolve the issue.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2017-14020

Affected Products

Automationdirect Click Programming

C-More Micro

C-More Programming

Directsoft Programming

Do-More Designer

Gs Drives Configuration

Sl-Soft Solo Temperature Controller Configuration

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-14020 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14020 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-17-313-01 · Note
• http://securityfocus.com/bid/101780 · Note