CVE-2014-9209

Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

CVSS v2.0 6.9 MEDIUM

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02	Third Party Advisory US Government Resource
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646323
https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02	Third Party Advisory US Government Resource
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646323

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rockwellautomation:factorytalk_services_platform::::::::
	cpe:2.3:a:rockwellautomation:factorytalk_view_studio::::::::

History

21 Nov 2024, 02:20

Type	Values Removed	Values Added
References	~~() https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02 - Third Party Advisory, US Government Resource~~	() https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02 - Third Party Advisory, US Government Resource
References	~~() https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646323 -~~	() https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646323 -

Information

Published : 2015-03-31 01:59

Updated : 2024-11-21 02:20

NVD link : CVE-2014-9209

Mitre link : CVE-2014-9209

CVE.ORG link : CVE-2014-9209

JSON object : View

Products Affected

rockwellautomation

factorytalk_services_platform
factorytalk_view_studio

CWE

NVD-CWE-Other

{"id": "CVE-2014-9209", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-03-31T01:59:19.783", "references": [{"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646323", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646323", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory."}, {"lang": "es", "value": "Vulnerabilidad de ruta de b\u00fasqueda no confiable en la aplicaci\u00f3n Clean Utility en Rockwell Automation FactoryTalk Services Platform anterior a 2.71.00 y FactoryTalk View Studio 8.00.00 y anteriores permite a usuarios locales ganar privilegios a trav\u00e9s de un DLL troyano en un directorio no especificado."}], "lastModified": "2024-11-21T02:20:24.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E53CB65-3967-4640-B69B-43187AC28CE7", "versionEndIncluding": "2.70.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:factorytalk_view_studio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A74F778A-7FED-45F5-8BF7-27A3B5DAED41", "versionEndIncluding": "8.00.00"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/426.html\">CWE-426: Untrusted Search Path</a>", "sourceIdentifier": "ics-cert@hq.dhs.gov"}