Vulnerability-Lookup

CNVD-2017-32170

Vulnerability from cnvd - Published: 2017-11-01

Title

Trihedral Engineering Limited VTScada DLL劫持漏洞

Description

VTScada是加拿大Trihedral Engineering公司的一套基于Windows平台提供Web界面选项的SCADA系统。 Trihedral Engineering Limited VTScada存在DLL劫持漏洞，攻击者可使程序执行放置在目标机器上的特制恶意dll文件。

Severity

高

Patch Name

Trihedral Engineering Limited VTScada DLL劫持漏洞的补丁

Patch Description

VTScada是加拿大Trihedral Engineering公司的一套基于Windows平台提供Web界面选项的SCADA系统。 Trihedral Engineering Limited VTScada存在DLL劫持漏洞，攻击者可使程序执行放置在目标机器上的特制恶意dll文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： ftp://ftp.trihedral.com/VTS/VTScada 11.3版本/

Reference

https://ics-cert.us-cert.gov/advisories/ICSA-17-304-02

Impacted products

Name
Trihedral Engineering Limited VTScada <=11.3.03

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-14029"
    }
  },
  "description": "VTScada\u662f\u52a0\u62ff\u5927Trihedral Engineering\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eWindows\u5e73\u53f0\u63d0\u4f9bWeb\u754c\u9762\u9009\u9879\u7684SCADA\u7cfb\u7edf\u3002\r\n\r\nTrihedral Engineering Limited VTScada\u5b58\u5728DLL\u52ab\u6301\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4f7f\u7a0b\u5e8f\u6267\u884c\u653e\u7f6e\u5728\u76ee\u6807\u673a\u5668\u4e0a\u7684\u7279\u5236\u6076\u610fdll\u6587\u4ef6\u3002",
  "discovererName": "Karn Ganeshen\u548cMark Cross",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a \r\nftp://ftp.trihedral.com/VTS/VTScada 11.3\u7248\u672c/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-32170",
  "openTime": "2017-11-01",
  "patchDescription": "VTScada\u662f\u52a0\u62ff\u5927Trihedral Engineering\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8eWindows\u5e73\u53f0\u63d0\u4f9bWeb\u754c\u9762\u9009\u9879\u7684SCADA\u7cfb\u7edf\u3002\r\n\r\nTrihedral Engineering Limited VTScada\u5b58\u5728DLL\u52ab\u6301\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4f7f\u7a0b\u5e8f\u6267\u884c\u653e\u7f6e\u5728\u76ee\u6807\u673a\u5668\u4e0a\u7684\u7279\u5236\u6076\u610fdll\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Trihedral Engineering Limited VTScada DLL\u52ab\u6301\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Trihedral Engineering Limited VTScada \u003c=11.3.03"
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-17-304-02",
  "serverity": "\u9ad8",
  "submitTime": "2017-11-01",
  "title": "Trihedral Engineering Limited VTScada DLL\u52ab\u6301\u6f0f\u6d1e"
}

CVE-2017-14029 (GCVE-0-2017-14029)

Vulnerability from cvelistv5 – Published: 2017-11-06 22:00 – Updated: 2024-08-05 19:13

Summary

An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files placed on the target machine.

Severity

No CVSS data available.

CWE

CWE-427

Assigner

icscert icscert root

References

1 reference

URL	Tags
https://ics-cert.us-cert.gov/advisories/ICSA-17-304-02	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Trihedral Engineering Limited VTScada	Affected: Trihedral Engineering Limited VTScada

Date Public

2017-11-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:13:41.624Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-304-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Trihedral Engineering Limited VTScada",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Trihedral Engineering Limited VTScada"
            }
          ]
        }
      ],
      "datePublic": "2017-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files placed on the target machine."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-06T21:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-304-02"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-14029",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Trihedral Engineering Limited VTScada",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Trihedral Engineering Limited VTScada"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files placed on the target machine."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-427"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-304-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-304-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2017-14029",
    "datePublished": "2017-11-06T22:00:00.000Z",
    "dateReserved": "2017-08-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T19:13:41.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.