ICSA-18-067-02_Siemens SIPROTEC 4, SIPROTEC Compact, and Reyrolle Devices using the EN100 Ethernet Communication Module Extension (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIPROTEC 4, SIPROTEC Compact, and Reyrolle devices using the EN100 Ethernet communication module extension Vulnerability: Missing Authentication for Critical Function 2. UPDATE...

Linux/x86_64 - Reverse Shell (192.168.1.8:4444) Shellcode (104 bytes)

/ ;Category: Shellcode ;Title: GNU/Linux x8664 - Reverse Shell Shellcode ;Author: m4n3dw0lf ;Github: https://github.com/m4n3dw0lf ;Date: 18/07/2017 ;Architecture: Linux x8664 ;Tested on: 1 SMP Debian 4.9.18-1 2017-03-30 x8664 GNU/Linux Source section .text global start start: push rbp mov rbp,rsp...

iec-identify NSE Script

Attempts to identify IEC 60870-5-104 ICS protocol. After probing with a TESTFR test frame message, a STARTDT start data transfer message is sent and general interrogation is used to gather the list of information object addresses stored. Example Usage nmap -sV --script=iec-identify Script Output ...

Siemens SIPROTEC 4 and SIPROTEC Compact (Update C)

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SIPROTEC 4 and SIPROTEC Compact Vulnerabilities: Improper Input Validation, Missing Authorization, Improper Authentication UPDATE INFORMATION This updated advisory is a follow-up to the updated...

MS13-104: Description of the security update for Office 2013: December 10, 2013

MS13-104: Description of the security update for Office 2013: December 10, 2013 INTRODUCTION Microsoft has released security bulletin MS13-104. To view the complete security bulletin, visit one of the following Microsoft websites: Home...

Microsoft Edge - 'CText­Extractor::Get­Block­Text' Out-of-Bounds Read (MS16-104)

::first-letter border: 0; white-space: pre-line; Aalert;&x­D;&x­D;B Description Though I did not investigate thoroughly, I did find out the following: The root cause appears to be an integer underflow in a 32-bit variable used in CText­Extractor..Get­Block­Text as an index to read a WCHAR in a...

Microsoft Edge CTextExtractor::GetBlockText Out-Of-Bounds Read Exploit

A specially crafted web-page can cause an integer underflow in Microsoft Edge. This causes CTextExtractor::GetBlockText to read data outside of the bounds of a memory block. Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before...

Microsoft Internet Explorer 11/10/9 - MSHTML 'PROPERTYDESC::Handle­Style­Component­Property' Out-of-Bounds Read (MS16-104)

// This Po­C attempts to exploit a memory disclosure bug in Microsoft Internet // Explorer 11. On x64 systems, this should cause an access violation when // run with page-heap enabled, as the code attempts to read a byte // immediately following a 4 byte memory block. // See...

Weak Password Vulnerability in Mapper VPN3005C-104 Appliance

The Maipu VPN3005C-104 device is a security gateway developed by Maipu. A weak password vulnerability exists in the Maipu VPN3005C-104 device. It allows an attacker to log in to the system backend and gain administrator privileges by using the account password admin\admin...

IEC 60870-5-104 Protocol Detection

Binary data 7229.pasl...

Microsoft Fixes 47 Vulnerabilities with September Patch Tuesday

Microsoft patched 47 vulnerabilities as part of 14 security bulletins, seven critical, with its monthly Patch Tuesday updates today. The company is warning users that if left unpatched, 10 of the issues can lead to remote execution. The updates resolve issues in Microsoft Windows, Office, Office...

Microsoft Internet Explorer Memory Corruption (MS16-104: CVE-2016-3295)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to a type confusion when handling certain objects in JavaScript. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page that could...

MS16-104: Cumulative security update for Internet Explorer: September 13, 2016

Resolves vulnerabilities that could allow remote code execution if a user views a specially crafted webpage in Internet Explorer.SummaryThis security update resolves several reported vulnerabilities in Internet Explorer. These vulnerabilities could allow remote code execution if a user views a...

Microsoft Internet Explorer Memory Corruption (MS16-104: CVE-2016-3324)

A remote code execution vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to a type confusion when handling certain objects in JavaScript. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page that could cause memory...

Microsoft Internet Explorer Memory Corruption (MS16-104: CVE-2016-3297)

A remote code execution vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to a type confusion when handling certain objects in JavaScript. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page that executes malicious...

CVE-2016-7112

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-7114

Siemens SIPROTEC 4/Compact EN100 Ethernet module family is affected by CVE-2016-7114 (Improper Authentication). The vulnerability allows remote attackers with network access to the device web interface (port 80) to possibly circumvent authentication and perform administrative operations, requirin...

CVE-2016-7112

CVE-2016-7112 is an Authentication Bypass vulnerability in the Siemens EN100 Ethernet module used with SIPROTEC 4/Compact and related equipment. Affected firmware variants PROFINET IO, Modbus TCP, DNP3 TCP, and IEC 104 in all SIPROTEC 4/Compact deployments allow remote attackers with access to th...

CVE-2016-4785

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-4784

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...