SB2018081705 - Multiple vulnerabilities in Tridium Niagara
Published: August 17, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Path traversal (CVE-ID: CVE-2017-16744)
The vulnerability allows a remote administrative attacker to cause DoS condition on the target system.
The vulnerability exists on Microsoft Windows Systems due to path traversal. A remote attacker can leverage valid platform (administrator) credentials and cause the service to crash or possibly execute arbitrary code.
2) Improper authentication (CVE-ID: CVE-2017-16748)
The vulnerability allows a local unauthenticated attacker to bypass authentication on the target system.
The vulnerability exists on Microsoft Windows Systems due to improper authentication. A local attacker can use a disabled account name and a blank password, log into the local Niagara platform and gain administrator access to the Niagara system.
Remediation
Install update from vendor's website.