Lucene search

[email protected]CVE-2009-0216

HistoryFeb 13, 2009 - 5:30 p.m.

CVE-2009-0216

2009-02-1317:30:00

CWE-255

[email protected]

web.nvd.nist.gov

ge fanuc

ifix 5.0

authentication

password file

remote attackers

access restrictions

privileged server login

cve-2009-0216

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.011 Low

EPSS

Percentile

84.9%

JSON

GE Fanuc iFIX 5.0 and earlier relies on client-side authentication involving a weakly encrypted local password file, which allows remote attackers to bypass intended access restrictions and start privileged server login sessions by recovering a password or by using a modified program module.

Affected configurations

NVD

Node

ge_fanucifixRange≤5.0

ge_fanucifixMatch2.0

ge_fanucifixMatch2.2

ge_fanucifixMatch2.5

ge_fanucifixMatch2.6

ge_fanucifixMatch2.21

ge_fanucifixMatch3.0

ge_fanucifixMatch3.5

ge_fanucifixMatch4.0

ge_fanucifixMatch4.5

CPENameOperatorVersion
ge_fanuc:ifixge fanuc ifixle5.0
ge_fanuc:ifixge fanuc ifixeq2.0
ge_fanuc:ifixge fanuc ifixeq2.2
ge_fanuc:ifixge fanuc ifixeq2.5
ge_fanuc:ifixge fanuc ifixeq2.6
ge_fanuc:ifixge fanuc ifixeq2.21
ge_fanuc:ifixge fanuc ifixeq3.0
ge_fanuc:ifixge fanuc ifixeq3.5
ge_fanuc:ifixge fanuc ifixeq4.0
ge_fanuc:ifixge fanuc ifixeq4.5

CPE	Name	Operator	Version
ge_fanuc:ifix	ge fanuc ifix	le	5.0
ge_fanuc:ifix	ge fanuc ifix	eq	2.0
ge_fanuc:ifix	ge fanuc ifix	eq	2.2
ge_fanuc:ifix	ge fanuc ifix	eq	2.5
ge_fanuc:ifix	ge fanuc ifix	eq	2.6
ge_fanuc:ifix	ge fanuc ifix	eq	2.21
ge_fanuc:ifix	ge fanuc ifix	eq	3.0
ge_fanuc:ifix	ge fanuc ifix	eq	3.5
ge_fanuc:ifix	ge fanuc ifix	eq	4.0
ge_fanuc:ifix	ge fanuc ifix	eq	4.5

References

support.gefanuc.com/support/index?page=kbchannel&id=S:KB13253&actp=search

www.kb.cert.org/vuls/id/310355

www.mcgrewsecurity.com/2009/02/10/ge-fanuc-releases-info-on-ifix-vulnerabilities-vu-310355/

www.securityfocus.com/bid/33739

exchange.xforce.ibmcloud.com/vulnerabilities/48691

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.011 Low

EPSS

Percentile

84.9%

JSON

Related for CVE-2009-0216

prion1 cvelist1 cert1 nvd1