PT-2011-4478 · Measuresoft · Scadapro

Luigi Auriemma · Publicado 2011-09-16 · Atualizado 2012-02-14 · CVE-2011-3497

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Measuresoft ScadaPro versions 4.0.0 and earlier

Description The issue allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.

Recommendations For versions 4.0.0 and earlier, consider disabling the XF function as a temporary workaround until a patch is available. Restrict access to the service.exe to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-3497

Produtos afetados

Scadapro

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/scadapro_cmdexe.rb · Exploit
• 🔥 http://aluigi.altervista.org/adv/scadapro_1-adv.txt · Exploit
• 🔥 https://exploit-db.com/exploits/17844 · Exploit
• http://us-cert.gov/control_systems/pdf/ICS-ALERT-11-256-04.pdf · Nota
• http://securityreason.com/securityalert/8382 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3497 · Nota de Segurança