Description
Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters.
Advisories 3
- ICSA-18-093-01 ICSA-18-093-01 Siemens Building Technologies Products (Update A) CISA ICS & IT advisories · Apr 3, 2018
- ICSA-18-018-01A ICSA-18-018-01A Siemens SIMATIC WinCC Add-On (Update A) CISA ICS & IT advisories · Feb 22, 2018
- ICSA-18-032-03 Gemalto Sentinel License Manager CISA ICS & IT advisories · Feb 1, 2018
References
- https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01
- https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-002-sentinel-ldk-rte-language-packs-containing-malformed-filenames-lead-to-remote-code-execution/
- https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
- 102906 vdb-entry
- https://www.iotvillage.org/slides_dc25/Sergey_Vlad_DEFCON_IOT_Village_Public2017.pptx
- 102739 vdb-entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01