CVE-2015-6485 - OpenCVE

Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01, and LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400, and Sage 3030M RTUs with firmware before C3414-500-S02J2, allow remote attackers to obtain sensitive information from device memory by reading a padding field of an Ethernet packet.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Schneider-electric	Telvent Rtu Firmware Sage Landac Ii-2 Sage 1450 Sage 1430 Sage 3030m Sage 2400 Sage 2300 Sage 1410

Configuration 1 [-]

AND

cpe:2.3:o:schneider-electric:telvent_rtu_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:schneider-electric:sage_1410:-:::::::*
	cpe:2.3:h:schneider-electric:sage_1430:-:::::::*
	cpe:2.3:h:schneider-electric:sage_1450:-:::::::*
	cpe:2.3:h:schneider-electric:sage_2400:-:::::::*
	cpe:2.3:h:schneider-electric:sage_3030m:-:::::::*
	cpe:2.3:h:schneider-electric:sage_landac_ii-2:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:h:schneider-electric:sage_2300:-:*:*:*:*:*:*:*

cpe:2.3:o:schneider-electric:telvent_rtu_firmware:*:*:*:*:*:*:*:*

References

Link	Resource
https://ics-cert.us-cert.gov/advisories/ICSA-16-070-01	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2016-03-12T02:00:00

Updated: 2016-03-12T02:57:01

Reserved: 2015-08-17T00:00:00

Link: CVE-2015-6485

JSON object: View

NVD Information

Status : Analyzed

Published: 2016-03-12T02:59:00.113

Modified: 2018-10-30T16:28:04.873

Link: CVE-2015-6485

JSON object: View

Redhat Information

No data.

CWE

CWE-200

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:telvent_rtu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "62D26165-D236-4015-9BFC-FCB18D9C439E", "versionEndIncluding": "c3414-500-s02j1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*", "matchCriteriaId": "02E606BD-92F8-4396-AD13-666D76E1E34D", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*", "matchCriteriaId": "97E29CCC-4E21-411E-80DD-545A66E9B042", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*", "matchCriteriaId": "66759867-027F-4FA6-ABA6-BFDEE49E8F8D", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*", "matchCriteriaId": "AA561E2A-4787-48D7-ABBB-26D0D7D24E6F", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sage_3030m:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF675FF2-416A-43AA-9DCF-0661DE9B3505", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:sage_landac_ii-2:-:*:*:*:*:*:*:*", "matchCriteriaId": "4892DAFA-A8E9-4714-B545-251A4EF4EAE0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:sage_2300:-:*:*:*:*:*:*:*", "matchCriteriaId": "C829F113-406B-4FFF-8413-7F3C1303C5DD", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:telvent_rtu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "90797CBE-6CE0-4452-A4E5-AE3BEFBCE034", "versionEndIncluding": "c3413-500-001d3", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01, and LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400, and Sage 3030M RTUs with firmware before C3414-500-S02J2, allow remote attackers to obtain sensitive information from device memory by reading a padding field of an Ethernet packet."}, {"lang": "es", "value": "Schneider Electric Telvent Sage 2300 RTUs con firmware anterior a C3413-500-S01 y LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400 y Sage 3030M RTUs con firmware anterior a C3414-500-S02J2, permiten a atacantes remotos obtener informaci\u00f3n sensible de memoria del dispositivo leyendo un campo de relleno de un paquete Ethernet."}], "id": "CVE-2015-6485", "lastModified": "2018-10-30T16:28:04.873", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-03-12T02:59:00.113", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-070-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}