full-disclosure - [FD] LAquis SCADA Access Control Vulnerability

Open Source and information security mailing list archives

Message-ID: <CAB8+WF1sB0D1SGwP6uuvVh=JGnFw-AfiZ8BL+dk=GShWj78ZWw@mail.gmail.com>
Date: Thu, 06 Apr 2017 19:43:43 +0000
From: Karn Ganeshen <karnganeshen@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] LAquis SCADA Access Control Vulnerability

LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA
Access Control Vulnerability

Vendor: LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME
Equipment: LAquis SCADA
Vulnerability: Improper Access Control

ICS-CERT Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-075-01

AFFECTED PRODUCTS

The following versions of LAquis SCADA, an industrial automation software,
are affected:
LAquis SCADA software, Versions 4.1 and prior versions released before
January 20, 2017.

IMPACT
Successful exploitation of this vulnerability could allow authenticated
system users to escalate their privileges and modify or replace application
files.

IMPROPER ACCESS CONTROL CWE-284
An Improper Access Control vulnerability has been identified, which may
allow an authenticated user to modify application files to escalate
privileges.

CVE-2017-6016 has been assigned to this vulnerability. A CVSS v3 base score
of 7.3 has been assigned; the CVSS vector string is
(AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

VULNERABILITY OVERVIEW

SCADA LAquis software is vulnerable to local privilege escalation. EVERYONE
has FULL permissions over all the install files (*exe,*dll), therefore, it
is possible for any local, authenticated, non-admin user to replace/modify
original application files with malicious ones, and gain higher privileged
access once an administrative user runs the application. Other vectors are
possible as well.

+++++

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives