PT-2011-2279 · Indusoft+1 · Indusoft Web Studio+2
Publicado
2011-05-04
·
Atualizado
2013-05-21
·
CVE-2011-0340
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
InduSoft Web Studio versions prior to 7.0+SP1
InduSoft Thin Client version 7.0
Advantech Studio version 6.1 SP6 61.6.01.05
Description
The issue allows remote attackers to execute arbitrary code via a long value in certain properties or method arguments, including
InternationalOrder, InternationalSeparator, or LogFileName property values, or a long bstrFileName argument to the OpenScreen method.Recommendations
For InduSoft Web Studio versions prior to 7.0+SP1, update to version 7.0+SP1 or later.
For InduSoft Thin Client version 7.0, consider disabling the
OpenScreen method or restricting access to the ISSymbol ActiveX control until a patch is available.
For Advantech Studio version 6.1 SP6 61.6.01.05, restrict the use of long values in the InternationalOrder, InternationalSeparator, or LogFileName properties to minimize the risk of exploitation.Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Advantech Studio
Indusoft Thin Client
Indusoft Web Studio