Vulnerability CVE-2012-1802 - CERT Civis.Net

Vulnerability Name:

CVE-2012-1802 (CCN-74670)

Assigned:

2012-04-05

Published:

2012-04-05

Updated:

2012-11-20

Summary:

Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
5.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2012-1802

Source: OSVDB
Type: UNKNOWN
81032

Source: CCN
Type: SA48730
Siemens Scalance X Switches HTTP Request Handling Denial of Service

Source: CCN
Type: OSVDB ID: 81032
Siemens Scalance Multiple X Switches HTTP Request Parsing Remote Overflow

Source: CCN
Type: BID-52933
Siemens Scalance X Switches 'HTTP' Request Denial of Service Vulnerability

Source: CCN
Type: SSA-130874
Multiple Security Vulnerabilities in Siemens Scalance X Switches

Source: CONFIRM
Type: Vendor Advisory
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-130874.pdf

Source: MISC
Type: US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-04.pdf

Source: XF
Type: UNKNOWN
siemens-scalance-request-dos(74670)

Vulnerable Configuration:

Configuration 1:

cpe:/a:siemens:scalance_x414-3e_firmware:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:2.3.2:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:3.3.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:3.4.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x414-3e_firmware:*:*:*:*:*:*:*:* (Version <= 3.7.0)

AND

cpe:/h:siemens:scalance_x414-3e:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:siemens:scalance_x308-2m_firmware:3.1.1:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x308-2m_firmware:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x308-2m_firmware:3.5.2:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x308-2m_firmware:*:*:*:*:*:*:*:* (Version <= 3.7.0)

AND

cpe:/h:siemens:scalance_x308-2m:-:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:siemens:scalance_x-300eec_firmware:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x-300eec_firmware:*:*:*:*:*:*:*:* (Version <= 3.7.0)

AND

cpe:/h:siemens:scalance_x-300eec:-:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:siemens:scalance_xr-300_firmware:3.1.1:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_xr-300_firmware:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_xr-300_firmware:*:*:*:*:*:*:*:* (Version <= 3.7.0)

AND

cpe:/h:siemens:scalance_xr-300:-:*:*:*:*:*:*:*

Configuration 5:

cpe:/a:siemens:scalance_x-300_firmware:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x-300_firmware:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x-300_firmware:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x-300_firmware:3.3.1:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x-300_firmware:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x-300_firmware:3.5.1:*:*:*:*:*:*:*

OR cpe:/a:siemens:scalance_x-300_firmware:*:*:*:*:*:*:*:* (Version <= 3.7.0)

AND

cpe:/h:siemens:scalance_x-300:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/h:siemens:scalance_x414-3e:-:*:*:*:*:*:*:*

OR cpe:/h:siemens:scalance_x308-2m:-:*:*:*:*:*:*:*

OR cpe:/h:siemens:scalance_x-300eec:-:*:*:*:*:*:*:*

OR cpe:/h:siemens:scalance_x-300:-:*:*:*:*:*:*:*

OR cpe:/h:siemens:scalance_xr-300:-:*:*:*:*:*:*:*

Denotes that component is vulnerable