07 декабря 2018

KLCERT-18-025: General Electric Proficy GDS XML eXternal Entity (XXE)

Vendor

General Electric

Timeline

Timeline

  • Kaspersky ICS CERT advisory published

    07 декабря 2018

  • The vendor releases a patch

    Декабрь 2018

  • The vendor has stopped replying regarding this issue. The problem is escalated to US ICS-CERT

    Январь 2018

Description

An XXE injection vulnerability leads to path traversal inside the Proficy server. An attacker may be able to initiate an OPC UA session and retrieve an arbitrary file from the target system.

CVSS v3

0.0

 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)

Exploitability

Remotely

Attack complexity

Low

User interaction

None

Impact

Successful exploitation of this vulnerability could allow an attacker to initiate an OPC UA session and retrieve an arbitrary file.

Existence of exploit

Unknown

Affected products

  • Cimplicity 9.0 R2,
  • Cimplicity 9.5, and
  • Cimplicity 10.0

Mitigation

Vendor mitigation

GE recommends users update to Version 2.1 or newer. The fixed version is available at the following link: https://ge-ip.flexnetoperations.com/control/geip/download?element=10544807 (Login required)

Kaspersky Lab publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky Lab does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

Вернуться к началу

Timeline

  • Kaspersky ICS CERT advisory published

    07 декабря 2018

  • The vendor releases a patch

    Декабрь 2018

  • The vendor has stopped replying regarding this issue. The problem is escalated to US ICS-CERT

    Январь 2018

Вернуться к началу
Подписка на рассылку