Security restrictions bypass in NCR S1 and S2

Published: 2018-08-10

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2017-17668 CVE-2018-5717
CWE-ID	CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	NCR S1 Hardware solutions / Firmware NCR S2 Hardware solutions / Firmware
Vendor	NCR Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Security restrictions bypass

EUVDB-ID: #VU14312

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17668

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to bypass security restrictions on the target system.

The weakness exists due to insufficient protection of memory write mechanism in NCR S1 Dispenser controller. remote attacker can upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities.

Mitigation

Update to version 0x0156.

Vulnerable software versions

NCR S1: before 0x0156

CPE2.3

cpe:2.3:h:ncr_corporation:ncr_s1:*:*:*:*:*:*:*:*

External links

http://www.ncr.com/content/dam/ncrcom/content-type/case_studies/ncr_security_alert_-_2018-04_v3.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU14313