NVD Vulnerability Detail

CVE-2017-11498

Summary	Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to shut down the remote process (a denial of service) via a language pack (ZIP file) with invalid HTML files.
Publication Date	Oct. 3, 2017, 10:29 a.m.
Registration Date	Jan. 26, 2021, 1:13 p.m.
Last Update	Nov. 21, 2024, 12:07 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:gemalto:sentinel_ldk_rte:3.0:::::::*
cpe:2.3:a:gemalto:sentinel_ldk_rte:7.1:::::::*
cpe:2.3:a:gemalto:sentinel_ldk_rte:2.10:::::::*
cpe:2.3:a:gemalto:sentinel_ldk_rte:7.50:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/102739
2	http://www.securityfocus.com/bid/102739
3	http://www.securityfocus.com/bid/102906
4	http://www.securityfocus.com/bid/102906
5	https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
6	https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
7	https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-001-sentinel-ldk-rte-language-pack-with-invalid-html-files-leads-to-denial-of-service/	Vendor Advisory
8	https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-001-sentinel-ldk-rte-language-pack-with-invalid-html-files-leads-to-denial-of-service/	Vendor Advisory
9	https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01
10	https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01
11	https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01
12	https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01
13	https://www.iotvillage.org/slides_dc25/Sergey_Vlad_DEFCON_IOT_Village_Public2017.pptx	Third Party Advisory
14	https://www.iotvillage.org/slides_dc25/Sergey_Vlad_DEFCON_IOT_Village_Public2017.pptx	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

Sentinel LDK におけるバッファエラーの脆弱性

Title	Sentinel LDK におけるバッファエラーの脆弱性
Summary	Sentinel LDK には、バッファエラーの脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 26, 2017, midnight
Registration Date	Oct. 31, 2017, 3:57 p.m.
Last Update	July 9, 2019, 3:59 p.m.

Affected System

Gemalto N.V.

Sentinel LDK

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-11498	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11498
National Vulnerability Database (NVD)
2	CVE-2017-11498	https://nvd.nist.gov/vuln/detail/CVE-2017-11498

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Gemalto
1	Sentinel LDK	https://sentinel.gemalto.com/software-monetization/sentinel-ldk/

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-18-018-01	https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01
2	ICSA-18-032-03	https://ics-cert.us-cert.gov/advisories/ICSA-18-032-03
3	ICSA-18-093-01	https://www.us-cert.gov/ics/advisories/ICSA-18-093-01
関連文書
4	KLCERT-17-001: Sentinel LDK RTE: language pack with invalid HTML files leads to Denial of Service	https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-001-sentinel-ldk-rte-language-pack-with-invalid-html-files-leads-to-denial-of-service/

Change Log

No	Changed Details	Date of change
0	[2017年10月31日] 掲載 [2018年01月22日] 参考情報：ICS-CERT ADVISORY (ICSA-18-018-01) を追加 [2018年02月05日] 参考情報：ICS-CERT ADVISORY (ICSA-18-032-03) を追加	Feb. 17, 2018, 10:37 a.m.
1	[2019年07月09日] 参考情報：ICS-CERT ADVISORY (ICSA-18-093-01) を追加	July 9, 2019, 3:56 p.m.