CVE-2018-17930
📋 TL;DR
A stack-based buffer overflow vulnerability in Teledyne DALSA Sherlock vision software allows remote attackers to execute arbitrary code on affected systems. This affects Sherlock versions 7.2.7.4 and earlier, potentially compromising industrial control systems and manufacturing environments.
💻 Affected Systems
- Teledyne DALSA Sherlock
📦 What is this software?
Sherlock by Teledynedalsa
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains full system control, installs malware, disrupts industrial processes, and pivots to other network systems.
Likely Case
Remote code execution leading to system compromise, data theft, and disruption of vision inspection systems in manufacturing environments.
If Mitigated
Limited impact if system is isolated, patched, or protected by network segmentation and application whitelisting.
🎯 Exploit Status
Buffer overflow vulnerabilities typically have low exploitation complexity once details are known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 7.2.7.5 or later
Vendor Advisory: https://www.teledynedalsa.com/en/products/imaging/vision-software/sherlock/
Restart Required: Yes
Instructions:
1. Download latest Sherlock version from Teledyne DALSA. 2. Backup current configuration. 3. Install update following vendor instructions. 4. Restart system. 5. Verify version is 7.2.7.5 or higher.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Sherlock systems from untrusted networks and internet access
Application Whitelisting
windowsImplement application control to prevent unauthorized code execution
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to Sherlock systems
- Deploy intrusion detection/prevention systems to monitor for exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check Sherlock version in application interface or installation directoryCheck Version:
Check Help > About in Sherlock application or review installation propertiesVerify Fix Applied:
Confirm version is 7.2.7.5 or higher in application interface📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Sherlock executable
- Memory access violations
- Network connections to unexpected destinations
Network Indicators:
- Unusual traffic patterns to/from Sherlock systems
- Exploit attempt signatures in network traffic
SIEM Query:
source="sherlock*" AND (event_type="process_creation" OR event_type="access_violation")🔗 References
- http://www.securityfocus.com/bid/105967
- https://ics-cert.us-cert.gov/advisories/ICSA-18-324-01%2C
- https://www.teledynedalsa.com/en/products/imaging/vision-software/sherlock/
- http://www.securityfocus.com/bid/105967
- https://ics-cert.us-cert.gov/advisories/ICSA-18-324-01%2C
- https://www.teledynedalsa.com/en/products/imaging/vision-software/sherlock/
