mitsubishielectric c_controller_module_setting_and_monitoring_tool 跨界内存写
CVE编号
CVE-2021-20587利用情况
暂无补丁情况
N/A披露时间
2021-02-20漏洞描述
Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (C Controller module setting and monitoring tool all versions, CPU Module Logging Configuration Tool all versions, CW Configurator all versions, Data Transfer all versions, EZSocket all versions, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GT SoftGOT1000 Version3 all versions, GT SoftGOT2000 Version1 all versions, GX Configurator-DP version 7.14Q and prior, GX Configurator-QP all versions, GX Developer all versions, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer all versions, GX RemoteService-I all versions, GX Works2 version 1.597X and prior, GX Works3 version 1.070Y and prior, M_CommDTM-HART all versions, M_CommDTM-IO-Link all versions, MELFA-Works all versions, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) all versions, MELSOFT Navigator all versions, MH11 SettingTool Version2 all versions, MI Configurator all versions, MT Works2 all versions, MX Component all versions, Network Interface Board CC IE Control utility all versions, Network Interface Board CC IE Field Utility all versions, Network Interface Board CC-Link Ver.2 Utility all versions, Network Interface Board MNETH utility all versions, PX Developer all versions, RT ToolBox2 all versions, RT ToolBox3 all versions, Setting/monitoring tools for the C Controller module all versions and SLMP Data Collector all versions) allows a remote unauthenticated attacker to cause a DoS condition of the software products, and possibly to execute a malicious program on the personal computer running the software products although it has not been reproduced, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets.解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| https://jvn.jp/vu/JVNVU92330101/index.html | |
| https://us-cert.cisa.gov/ics/advisories/icsa-21-049-02 | |
| https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-021_en.pdf |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | cpu_module_logging_configuration_tool | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | cw_configurator | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | c_controller_module_setting_and_monitoring_tool | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | data_transfer | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | ezsocket | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | fr_configurator | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | fr_configurator2 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | fr_configurator_sw3 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gt_got1000 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gt_got2000 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gt_softgot1000 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gt_softgot2000 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_configurator-dp | * | Up to (including) 7.14q | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_configurator-qp | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_developer | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_explorer | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_iec_developer | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_logviewer | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_remoteservice-i | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_works2 | * | Up to (including) 1.597x | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | gx_works3 | * | Up to (including) 1.070y | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | melfa-works | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | melsec_wincpu_setting_utility | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | melsoft_em_software_development_kit | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | melsoft_navigator | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | mh11_settingtool_version2 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | mi_configurator | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | mt_works2 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | mx_component | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | m_commdtm-hart | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | m_commdtm-io-link | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | network_interface_board_cc-link | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | network_interface_board_cc_ie_control_utility | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | network_interface_board_cc_ie_field_utility | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | network_interface_board_mneth_utility | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | px_developer | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | rt_toolbox2 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | rt_toolbox3 | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | setting/monitoring_tools_for_the_c_controller_module | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | mitsubishielectric | slmp_data_collector | * | - | |||||
- 攻击路径 网络
- 攻击复杂度 低
- 权限要求 无
- 影响范围 未更改
- 用户交互 无
- 可用性 高
- 保密性 高
- 完整性 高
| CWE-ID | 漏洞类型 |
| CWE-787 | 跨界内存写 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论