PT-2011-2281 · Indusoft · Indusoft Web Studio

Dmitry Pletnev · Publicado 2011-09-02 · Atualizado 2013-05-21 · CVE-2011-0342

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InduSoft Web Studio version 7.0B2 hotfix 7.0.01.04

Description The issue concerns multiple buffer overflows in the InduSoft ISSymbol ActiveX control. These overflows can be triggered by passing a long parameter to specific methods, allowing remote attackers to execute arbitrary code. The affected methods include the Open(), Close(), and SetCurrentLanguage() functions.

Recommendations For InduSoft Web Studio version 7.0B2 hotfix 7.0.01.04, consider disabling the ISSymbol ActiveX control until a patch is available to prevent exploitation through the Open(), Close(), and SetCurrentLanguage() methods. Restrict access to these methods to minimize the risk of arbitrary code execution.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2011-0342

Produtos afetados

Indusoft Web Studio

Referências · 6

• http://indusoft.com/hotfixes/hotfixes.php · Nota
• http://ics-cert.us-cert.gov/advisories/ICSA-11-273-02 · Nota
• http://secunia.com/advisories/44875 · Aviso do Fabricante
• http://secunia.com/secunia_research/2011-61 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0342 · Nota de Segurança
• http://securityfocus.com/bid/49403 · Nota