lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 27 Jun 2017 23:31:22 +0000 From: Karn Ganeshen <karnganeshen@...il.com> To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org> Subject: [FD] Schneider Electric Interactive Graphical SCADA System Software – Insecure Library Loading Allows Code Execution Vendor: Schneider Electric Equipment: Interactive Graphical SCADA System (IGSS) Software Vulnerability: DLL Hijacking Advisory URL: https://ipositivesecurity.com/2017/05/18/ics-schneider-electric-interactive-graphical-scada-system-software-insecure-library-loading-allows-code-execution/ ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-094-01 ------------------------ AFFECTED PRODUCTS ------------------------ Schneider Electric reports that the vulnerability affects the following IGSS HMI desktop application: IGSS Software, Version 12 and previous versions. ------------------------ IMPACT ------------------------ An attacker who exploits this vulnerability may be able to remotely execute arbitrary code. ------------------------ VULNERABILITY OVERVIEW ------------------------ UNCONTROLLED SEARCH PATH ELEMENT CWE-427 The software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path. CVE-2017-6033 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). ------------------------ Vulnerable Libraries: ------------------------ msjet48.dll msjet47.dll msjet46.dll msjet45.dll msjet44.dll msjet43.dll msjet42.dll msjet41.dll hhctrl.ocx ------------------------ Application Executables (that look for missing DLL): ------------------------ igss.exe igss_dde.exe IGSSdataServer.exe genhdm.exe mre.exe RsLinxTo7TABSLC.exe WinBROWSE.exe ------------------------ Application Executables (that look for missing OCX): ------------------------ errcode.exe def.exe chelm.exe ------------------------ Steps to reproduce ------------------------ 1. Generate a dll payload msfvenom –p windows/exec cmd=calc.exe –f dll –o msjet41.dll 2. Place this dll (or any of above listed dlls) in install directory (or C:\Windows, or any directory defined in the PATH environment variable) C:\app-folder-RW\ 3. Run igss.exe -> calc.exe will execute +++++ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists