CVE-2012-5409

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference

Severity Score

10.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.

AscoServer.exe en el servidor en Siemens SiPass integrated MP2.6 y anteriores no trata correctamente los mensajes RPC IOCP recibidos a través de una red Ethernet, lo que permite a atacantes remotos escribir datos en cualquier posición de memoria y por lo tanto ejecutar código de su elección a través de mensajes modificados a mano, tal y como se ha demostrado por un ataque de desreferencia de un puntero de su elección o un ataque de desbordamiento de búfer.

*Credits: N/A

CVSS Scores

NISTv2 10.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-10-17 CVE Reserved
2012-11-01 CVE Published
2012-11-01 First Exploit
2024-07-31 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (6)

URL	Tag	Source
http://ics-cert.us-cert.gov/advisories/ICSA-12-305-01	X_refsource_misc
http://ioactive.com/pdfs/SIEMENS_Sipass_Integrated_Ethernet_Bus_Arbitrary_Pointer_Dereference_V4.pdf	X_refsource_misc
http://www.osvdb.org/86129	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/22397	2012-11-01

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/50900	2013-05-21
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-938777.pdf	2013-05-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"		Sipass Integrated Search vendor "Siemens" for product "Sipass Integrated"				<= mp2.6 Search vendor "Siemens" for product "Sipass Integrated" and version " <= mp2.6"		-		Affected