SB2017083003 - Multiple vulnerabilities in Adventech WebAccess

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) SQL injection (CVE-ID: CVE-2017-12710)

The vulnerability allows a remote attacker to execute SQL commands on the target system.

The weakness exists due to improper input validation. A remote attacker can supply a specially crafted parameter value to execute SQL commands on the underlying database and gain access to arbitrary data.

Successful exploitation of the vulnerability results in information disclosure.

2) Memory corruption (CVE-ID: CVE-2017-12708)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious input. A remote attacker can trick the victim into opening a specially crafted data, trigger memory corruption and cause the system crash or execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

3) Stack-based buffer overflow (CVE-ID: CVE-2017-12706)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow when handling malicious input. A remote attacker can trick the victim into opening a specially crafted data, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

4) Heap-based buffer overflow (CVE-ID: CVE-2017-12704)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow when handling malicious input. A remote attacker can trick the victim into opening a specially crafted data, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

5) Remote code execution (CVE-ID: CVE-2017-12702)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper validation of string format specifiers based on user provided input. A remote attacker can supply a specially crafted string and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

6) Authentication bypass (CVE-ID: CVE-2017-12698)

The vulnerability allows a remote attacker to bypass authentication on the target system.

The weakness exists due to improper authentication. A remote attacker can supply specially crafted requests to bypass authentication and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

7) Insecure DLL loading (CVE-ID: CVE-2017-12717)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to untrusted search path element. A local attacker can load a specially crafted .dll file, gain root access and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

8) Privilege escalation (CVE-ID: CVE-2017-12711)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to sensitive privilege for a built-in user account. A local attacker can gain root access and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

9) Privilege escalation (CVE-ID: CVE-2017-12713)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to incorrect permission assignment. A local attacker can modify multiple files and folders with ACLs gain root access and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Install update from vendor's website.

References

• https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02