CVE-2015-5627

Published: Feb 5, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (process outage) via a crafted packet.

Affected (22)

Products: Yokogawa: Centum Cs 1000 Firmware, Centum Cs 3000 Firmware, Centum Cs 3000 Entry Firmware, Centum Vp Firmware, Centum Vp Entry Firmware, Prosafe Rs Firmware, Exaopc, Exapilot, Exaplog, Exaquantum, Exaquantum/batch, Exarqe, Exasmoc, Field Wireless Device Opc Server, Plant Resource Manager, Scada Software (fast/tools), Versatile Data Server Software, B/m9000cs Firmware, B/m9000 Vp Firmware, Fieldmate, Stardom Opc Server

Yokogawa

21 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Centum Cs 1000 Firmware	Up to r3.08.70

Running on/with	Platform Versions
Yokogawa Centum Cs 1000	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Centum Cs 3000 Firmware	Up to r3.09.50

Running on/with	Platform Versions
Yokogawa Centum Cs 3000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Centum Cs 3000 Entry Firmware	Up to r3.09.50

Running on/with	Platform Versions
Yokogawa Centum Cs 3000 Entry	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Centum Vp Firmware	Up to r5.04.20

Running on/with	Platform Versions
Yokogawa Centum Vp	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Centum Vp Entry Firmware	Up to r5.04.20

Running on/with	Platform Versions
Yokogawa Centum Vp Entry	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Prosafe Rs Firmware	Up to r3.02.10

Running on/with	Platform Versions
Yokogawa Prosafe Rs	All versions

Configuration G

7 vulnerable

Vulnerable Software	Affected Versions
Yokogawa Exaopc	Up to r3.72.00
Yokogawa Exapilot	Up to r3.96.10
Yokogawa Exaplog	Up to r3.40.00
Yokogawa Exaquantum	Up to r2.85.00
Yokogawa Exaquantum/batch	Up to r2.50.30
Yokogawa Exarqe	Up to r4.03.20
Yokogawa Exasmoc	Up to r4.03.20

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Field Wireless Device Opc Server	Up to r2.01.02

Running on/with	Platform Versions
Yokogawa Field Wireless Device Opc Server	All versions

Configuration I

3 vulnerable

Vulnerable Software	Affected Versions
Yokogawa Plant Resource Manager	Up to r3.12.00
Yokogawa Scada Software (fast/tools)	Up to r10.01
Yokogawa Versatile Data Server Software	Up to r7.30.01

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa B/m9000cs Firmware	Up to r5.05.01

Running on/with	Platform Versions
Yokogawa B/m9000cs	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa B/m9000 Vp Firmware	Up to r7.03.04

Running on/with	Platform Versions
Yokogawa B/m9000 Vp	All versions

Configuration L

2 vulnerable

Vulnerable Software	Affected Versions
Yokogawa Fieldmate	Version r1.01
Yokogawa Fieldmate	Version r1.02

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yokogawa Stardom Opc Server	Up to r3.40

Running on/with	Platform Versions
Yokogawa Stardom Opc Server	All versions

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf

Source: vultures@jpcert.or.jp

Not Applicable

https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01

Source: vultures@jpcert.or.jp

MitigationThird Party AdvisoryUS Government Resource

http://www.yokogawa.com/dcs/security/ysar/YSAR-15-0003E.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.