Vulnerability-Lookup

BDU:2019-04212

Vulnerability from fstec - Published: 11.09.2018

Title

Уязвимость программного обеспечения Siemens, связанная с неправильным контролем доступа, позволяющая нарушителю повысить свои привилегии

Description

Уязвимость программного обеспечения Siemens связана с неправильным контролем доступа. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии, в результате использования путей без кавычек для продуктов не установленых по пути по умолчанию ("C:\Program Files\*")

Severity ?


                    
                      AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Vendor

Siemens AG

Software Name

SIMATIC PCS 7, SIMATIC STEP 7 (TIA Portal), SIMATIC WinCC (TIA Portal) Advanced, SIMATIC WinCC (TIA Portal) Basic, SIMATIC WinCC (TIA Portal) Comfort, SIMATIC WinCC (TIA Portal) Professional, SIMATIC WinCC Runtime Professional, SIMATIC WinCC, SINEMA Remote Connect, SINEMA Server, SOFTNET Security Client, Security Configuration Tool, TeleControl Server Basic, Simatic IT Production Suite, Simatic NET PC-Software, SIMATIC WinAC RTX 2010 incl. F, Primary Setup Tool (PST), SIMIT

Software Version

до 7.1 включительно (SIMATIC PCS 7), 8.0 (SIMATIC PCS 7), 8.1 (SIMATIC PCS 7), от 13 до 13 SP2 (SIMATIC STEP 7 (TIA Portal)), до V14 (SIMATIC WinCC (TIA Portal) Advanced), до V14 (SIMATIC WinCC (TIA Portal) Basic), до V14 (SIMATIC WinCC (TIA Portal) Comfort), от V13 до V13 SP2 (SIMATIC WinCC (TIA Portal) Professional), от V14 до V14 SP1 (SIMATIC WinCC (TIA Portal) Professional), от V13 до V13 SP2 (SIMATIC WinCC Runtime Professional), от V14 до V14 SP1 (SIMATIC WinCC Runtime Professional), от 7.0 SP2 до 7.0 SP2 Upd 12 (SIMATIC WinCC), от 7.0 SP3 до 7.0 SP3 Upd 8 (SIMATIC WinCC), от 7.2 до 7.2 Upd 14 (SIMATIC WinCC), от 7.3 до 7.3 Upd 11 (SIMATIC WinCC), от 7.4 до 7.4 SP1 (SIMATIC WinCC), до 1.0 SP3 (SINEMA Remote Connect), до 13 SP2 (SINEMA Server), V5.0 (SOFTNET Security Client), до V4.3 HF1 (Security Configuration Tool), до V3.0 SP2 (TeleControl Server Basic), до V7.0 SP1 HFX 2 (Simatic IT Production Suite), до V14 (Simatic NET PC-Software), от V8.2 до V8.2 SP1 (SIMATIC PCS 7), от V5.0 до V5.5 SP4 HF11 (SIMATIC STEP 7 (TIA Portal)), от SP2 до SP3 (SIMATIC WinAC RTX 2010 incl. F), до V4.2 HF1 (Primary Setup Tool (PST)), от V9.0 до V9.0 SP1 (SIMIT)

Possible Mitigations

Обновление программного обеспечения : Для SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced до V14: https://support.industry.siemens.com/cs/ww/en/view/109739719 Для SIMATIC WinCC (TIA Portal) Professional до V13 SP2: https://support.industry.siemens.com/cs/ww/en/view/109745155 Для SIMATIC WinCC (TIA Portal) Professional до V14 SP1: https://support.industry.siemens.com/cs/ww/en/view/109746074 Для SIMATIC WinCC Runtime Professional до V13 SP2: https://support.industry.siemens.com/cs/ww/en/view/109746075 Для SIMATIC WinCC Runtime Professional до V14 SP1: https://support.industry.siemens.com/cs/ww/en/view/109746276 Для SIMATIC WinCC V7.0 SP2 до V7.0 SP2 Upd 12: https://support.industry.siemens.com/cs/ww/en/view/109741519 Для SIMATIC WinCC до V7.0 SP3 Upd 8: https://support.industry.siemens.com/cs/ww/en/view/109741127 Для SIMATIC WinCC до V7.2 Upd 14: https://support.industry.siemens.com/cs/ww/en/view/109745028 Для SIMATIC WinCC до V7.3 Upd 11: https://support.industry.siemens.com/cs/ww/en/view/109742642 Для SIMATIC WinCC до V7.4 SP1: https://support.industry.siemens.com/cs/ww/en/view/109746038 Для Primary Setup Tool (PST) до V4.2 HF1: https://support.industry.siemens.com/cs/ww/en/view/19440762 Для SIMATIC IT Production Suite до V7.0 SP1 HFX 2: https://mes-simaticit.siemens.com/tss/html/hfc.html Для SIMATIC NET PC-Software до V14: https://support.industry.siemens.com/cs/ww/en/view/109741996 Для SIMATIC PCS 7 V7.1, V8.0,V8.1 и SOFTNET Security Client V5.0 до SIMATIC WinCC V7.3 Upd 11 (Временное исправление): https://support.industry.siemens.com/cs/ww/en/view/109740929 Для SIMIT V9.0 до V9.0 SP1: https://support.industry.siemens.com/cs/ww/en/view/109743963 Для SINEMA Remote Connect Client до V1.0 SP3: https://support.industry.siemens.com/cs/ww/en/view/109754280 Для SINEMA Server до V13 SP2: https://support.industry.siemens.com/cs/ww/en/view/109741833 Для Security Configuration Tool (SCT) до V4.3 HF1: https://support.industry.siemens.com/cs/ww/en/view/109744041 Для TeleControl Server Basic до V3.0 SP2: https://support.industry.siemens.com/cs/ww/en/view/109483119

Reference

https://cert-portal.siemens.com/productcert/pdf/ssa-701708.pdf https://nvd.nist.gov/vuln/detail/CVE-2016-7165 https://www.us-cert.gov/ics/advisories/ICSA-16-313-02

CWE

CWE-254, CWE-269, CWE-284

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Siemens AG",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 7.1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SIMATIC PCS 7), 8.0 (SIMATIC PCS 7), 8.1 (SIMATIC PCS 7), \u043e\u0442 13 \u0434\u043e 13 SP2 (SIMATIC STEP 7 (TIA Portal)), \u0434\u043e V14 (SIMATIC WinCC (TIA Portal) Advanced), \u0434\u043e V14 (SIMATIC WinCC (TIA Portal) Basic), \u0434\u043e V14 (SIMATIC WinCC (TIA Portal) Comfort), \u043e\u0442 V13 \u0434\u043e V13 SP2 (SIMATIC WinCC (TIA Portal) Professional), \u043e\u0442 V14 \u0434\u043e V14 SP1 (SIMATIC WinCC (TIA Portal) Professional), \u043e\u0442 V13 \u0434\u043e V13 SP2 (SIMATIC WinCC Runtime Professional), \u043e\u0442 V14 \u0434\u043e V14 SP1 (SIMATIC WinCC Runtime Professional), \u043e\u0442 7.0 SP2 \u0434\u043e 7.0 SP2 Upd 12 (SIMATIC WinCC), \u043e\u0442 7.0 SP3 \u0434\u043e 7.0 SP3 Upd 8 (SIMATIC WinCC), \u043e\u0442 7.2 \u0434\u043e 7.2 Upd 14 (SIMATIC WinCC), \u043e\u0442 7.3 \u0434\u043e 7.3 Upd 11 (SIMATIC WinCC), \u043e\u0442 7.4 \u0434\u043e 7.4 SP1 (SIMATIC WinCC), \u0434\u043e 1.0 SP3 (SINEMA Remote Connect), \u0434\u043e 13 SP2 (SINEMA Server), V5.0 (SOFTNET Security Client), \u0434\u043e V4.3 HF1 (Security Configuration Tool), \u0434\u043e V3.0 SP2 (TeleControl Server Basic), \u0434\u043e V7.0 SP1 HFX 2 (Simatic IT Production Suite), \u0434\u043e V14 (Simatic NET PC-Software), \u043e\u0442 V8.2 \u0434\u043e V8.2 SP1 (SIMATIC PCS 7), \u043e\u0442 V5.0 \u0434\u043e V5.5 SP4 HF11 (SIMATIC STEP 7 (TIA Portal)), \u043e\u0442 SP2 \u0434\u043e SP3 (SIMATIC WinAC RTX 2010 incl. F), \u0434\u043e V4.2 HF1 (Primary Setup Tool (PST)), \u043e\u0442 V9.0 \u0434\u043e V9.0 SP1 (SIMIT)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f :\n\n\u0414\u043b\u044f SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced \u0434\u043e V14:\nhttps://support.industry.siemens.com/cs/ww/en/view/109739719\n\n\u0414\u043b\u044f SIMATIC WinCC (TIA Portal) Professional \u0434\u043e V13 SP2:\nhttps://support.industry.siemens.com/cs/ww/en/view/109745155\n\n\u0414\u043b\u044f SIMATIC WinCC (TIA Portal) Professional \u0434\u043e V14 SP1:\nhttps://support.industry.siemens.com/cs/ww/en/view/109746074\n\n\u0414\u043b\u044f SIMATIC WinCC Runtime Professional \u0434\u043e V13 SP2:\nhttps://support.industry.siemens.com/cs/ww/en/view/109746075\n\n\u0414\u043b\u044f SIMATIC WinCC Runtime Professional \u0434\u043e V14 SP1:\nhttps://support.industry.siemens.com/cs/ww/en/view/109746276\n\n\u0414\u043b\u044f SIMATIC WinCC V7.0 SP2 \u0434\u043e V7.0 SP2 Upd 12:\nhttps://support.industry.siemens.com/cs/ww/en/view/109741519\n\n\u0414\u043b\u044f SIMATIC WinCC \u0434\u043e V7.0 SP3 Upd 8:\nhttps://support.industry.siemens.com/cs/ww/en/view/109741127\n\n\u0414\u043b\u044f SIMATIC WinCC \u0434\u043e V7.2 Upd 14:\nhttps://support.industry.siemens.com/cs/ww/en/view/109745028\n\n\u0414\u043b\u044f SIMATIC WinCC \u0434\u043e V7.3 Upd 11:\nhttps://support.industry.siemens.com/cs/ww/en/view/109742642\n\n\u0414\u043b\u044f SIMATIC WinCC \u0434\u043e V7.4 SP1:\nhttps://support.industry.siemens.com/cs/ww/en/view/109746038\n\n\u0414\u043b\u044f Primary Setup Tool (PST) \u0434\u043e V4.2 HF1:\nhttps://support.industry.siemens.com/cs/ww/en/view/19440762\n\n\u0414\u043b\u044f SIMATIC IT Production Suite \u0434\u043e V7.0 SP1 HFX 2:\nhttps://mes-simaticit.siemens.com/tss/html/hfc.html\n\n\u0414\u043b\u044f SIMATIC NET PC-Software \u0434\u043e V14:\nhttps://support.industry.siemens.com/cs/ww/en/view/109741996\n\n\u0414\u043b\u044f SIMATIC PCS 7 V7.1, V8.0,V8.1 \u0438 SOFTNET Security Client V5.0 \u0434\u043e SIMATIC WinCC V7.3 Upd 11 (\u0412\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435):\nhttps://support.industry.siemens.com/cs/ww/en/view/109740929\n\n\u0414\u043b\u044f SIMIT V9.0 \u0434\u043e V9.0 SP1:\nhttps://support.industry.siemens.com/cs/ww/en/view/109743963\n\n\u0414\u043b\u044f SINEMA Remote Connect Client \u0434\u043e V1.0 SP3:\nhttps://support.industry.siemens.com/cs/ww/en/view/109754280\n\n\u0414\u043b\u044f SINEMA Server \u0434\u043e V13 SP2:\nhttps://support.industry.siemens.com/cs/ww/en/view/109741833\n\n\u0414\u043b\u044f Security Configuration Tool (SCT) \u0434\u043e V4.3 HF1:\nhttps://support.industry.siemens.com/cs/ww/en/view/109744041\n\n\u0414\u043b\u044f TeleControl Server Basic \u0434\u043e V3.0 SP2:\nhttps://support.industry.siemens.com/cs/ww/en/view/109483119",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.09.2018",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "25.11.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "25.11.2019",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-04212",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2016-7165",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SIMATIC PCS 7, SIMATIC STEP 7 (TIA Portal), SIMATIC WinCC (TIA Portal) Advanced, SIMATIC WinCC (TIA Portal) Basic, SIMATIC WinCC (TIA Portal) Comfort, SIMATIC WinCC (TIA Portal) Professional, SIMATIC WinCC Runtime Professional, SIMATIC WinCC, SINEMA Remote Connect, SINEMA Server, SOFTNET Security Client, Security Configuration Tool, TeleControl Server Basic, Simatic IT Production Suite, Simatic NET PC-Software, SIMATIC WinAC RTX 2010 incl. F, Primary Setup Tool (PST), SIMIT",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Siemens, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u042d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CWE-254), \u041d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 (CWE-269), \u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (CWE-284)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Siemens \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0443\u0442\u0435\u0439 \u0431\u0435\u0437 \u043a\u0430\u0432\u044b\u0447\u0435\u043a \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b\u0445 \u043f\u043e \u043f\u0443\u0442\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e (\"C:\\Program Files\\*\")",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://cert-portal.siemens.com/productcert/pdf/ssa-701708.pdf\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7165\nhttps://www.us-cert.gov/ics/advisories/ICSA-16-313-02",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-254, CWE-269, CWE-284",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,9)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,4)"
}

CVE-2016-7165 (GCVE-0-2016-7165)

Vulnerability from cvelistv5 – Published: 2016-11-15 19:00 – Updated: 2024-08-06 01:50

Summary

A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions < V14), SIMATIC PCS 7 V7.1 (All versions), SIMATIC PCS 7 V8.0 (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2), SIMATIC STEP 7 V5.X (All versions < V5.5 SP4 HF11), SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced (All versions < V14), SIMATIC WinCC (TIA Portal) Professional V13 (All versions < V13 SP2), SIMATIC WinCC (TIA Portal) Professional V14 (All versions < V14 SP1), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1), SIMATIC WinCC V7.0 SP2 and earlier versions (All versions < V7.0 SP2 Upd 12), SIMATIC WinCC V7.0 SP3 (All versions < V7.0 SP3 Upd 8), SIMATIC WinCC V7.2 (All versions < V7.2 Upd 14), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 11), SIMATIC WinCC V7.4 (All versions < V7.4 SP1), SIMIT V9.0 (All versions < V9.0 SP1), SINEMA Remote Connect Client (All versions < V1.0 SP3), SINEMA Server (All versions < V13 SP2), SOFTNET Security Client V5.0 (All versions), Security Configuration Tool (SCT) (All versions < V4.3 HF1), TeleControl Server Basic (All versions < V3.0 SP2), WinAC RTX 2010 SP2 (All versions), WinAC RTX F 2010 SP2 (All versions). Unquoted service paths could allow local Microsoft Windows operating system users to escalate their privileges if the affected products are not installed under their default path ("C:\Program Files\*" or the localized equivalent).

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://ics-cert.us-cert.gov/advisories/ICSA-16-313-02	x_refsource_MISC
	http://securityaffairs.co/wordpress/53266/securit…	x_refsource_MISC
	http://www.securityfocus.com/bid/94158	vdb-entryx_refsource_BID
	https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM

Date Public ?

2016-11-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:50:47.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-313-02"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://securityaffairs.co/wordpress/53266/security/cve-2016-7165-siemens.html"
          },
          {
            "name": "94158",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94158"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701708.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Primary Setup Tool (PST) (All versions \u003c V4.2 HF1), SIMATIC IT Production Suite (All versions \u003c V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions \u003c V14), SIMATIC PCS 7 V7.1 (All versions), SIMATIC PCS 7 V8.0 (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions \u003c V13 SP2), SIMATIC STEP 7 V5.X (All versions \u003c V5.5 SP4 HF11), SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced (All versions \u003c V14), SIMATIC WinCC (TIA Portal) Professional V13 (All versions \u003c V13 SP2), SIMATIC WinCC (TIA Portal) Professional V14 (All versions \u003c V14 SP1), SIMATIC WinCC Runtime Professional V13 (All versions \u003c V13 SP2), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14 SP1), SIMATIC WinCC V7.0 SP2 and earlier versions (All versions \u003c V7.0 SP2 Upd 12), SIMATIC WinCC V7.0 SP3 (All versions \u003c V7.0 SP3 Upd 8), SIMATIC WinCC V7.2 (All versions \u003c V7.2 Upd 14), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 11), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1), SIMIT V9.0 (All versions \u003c V9.0 SP1), SINEMA Remote Connect Client (All versions \u003c V1.0 SP3), SINEMA Server (All versions \u003c V13 SP2), SOFTNET Security Client V5.0 (All versions), Security Configuration Tool (SCT) (All versions \u003c V4.3 HF1), TeleControl Server Basic (All versions \u003c V3.0 SP2), WinAC RTX 2010 SP2 (All versions), WinAC RTX F 2010 SP2 (All versions). Unquoted service paths could allow local Microsoft Windows operating system users to escalate their privileges if the affected products are not installed under their default path (\"C:\\Program Files\\*\" or the localized equivalent)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-14T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-313-02"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://securityaffairs.co/wordpress/53266/security/cve-2016-7165-siemens.html"
        },
        {
          "name": "94158",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94158"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701708.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-7165",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in Primary Setup Tool (PST) (All versions \u003c V4.2 HF1), SIMATIC IT Production Suite (All versions \u003c V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions \u003c V14), SIMATIC PCS 7 V7.1 (All versions), SIMATIC PCS 7 V8.0 (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions \u003c V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions \u003c V13 SP2), SIMATIC STEP 7 V5.X (All versions \u003c V5.5 SP4 HF11), SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced (All versions \u003c V14), SIMATIC WinCC (TIA Portal) Professional V13 (All versions \u003c V13 SP2), SIMATIC WinCC (TIA Portal) Professional V14 (All versions \u003c V14 SP1), SIMATIC WinCC Runtime Professional V13 (All versions \u003c V13 SP2), SIMATIC WinCC Runtime Professional V14 (All versions \u003c V14 SP1), SIMATIC WinCC V7.0 SP2 and earlier versions (All versions \u003c V7.0 SP2 Upd 12), SIMATIC WinCC V7.0 SP3 (All versions \u003c V7.0 SP3 Upd 8), SIMATIC WinCC V7.2 (All versions \u003c V7.2 Upd 14), SIMATIC WinCC V7.3 (All versions \u003c V7.3 Upd 11), SIMATIC WinCC V7.4 (All versions \u003c V7.4 SP1), SIMIT V9.0 (All versions \u003c V9.0 SP1), SINEMA Remote Connect Client (All versions \u003c V1.0 SP3), SINEMA Server (All versions \u003c V13 SP2), SOFTNET Security Client V5.0 (All versions), Security Configuration Tool (SCT) (All versions \u003c V4.3 HF1), TeleControl Server Basic (All versions \u003c V3.0 SP2), WinAC RTX 2010 SP2 (All versions), WinAC RTX F 2010 SP2 (All versions). Unquoted service paths could allow local Microsoft Windows operating system users to escalate their privileges if the affected products are not installed under their default path (\"C:\\Program Files\\*\" or the localized equivalent)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-313-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-313-02"
            },
            {
              "name": "http://securityaffairs.co/wordpress/53266/security/cve-2016-7165-siemens.html",
              "refsource": "MISC",
              "url": "http://securityaffairs.co/wordpress/53266/security/cve-2016-7165-siemens.html"
            },
            {
              "name": "94158",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94158"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-701708.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-701708.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-7165",
    "datePublished": "2016-11-15T19:00:00.000Z",
    "dateReserved": "2016-09-08T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:50:47.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2019-04212

CVE-2016-7165 (GCVE-0-2016-7165)

Tags

Sightings

Nomenclature