PT-2012-4431 · Invensys · Intouch/Wonderware Application Server It+5

Publicado 2012-07-05 · Atualizado 2012-08-14 · CVE-2012-3007

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Invensys Wonderware SuiteLink versions prior to 58.x InTouch/Wonderware Application Server IT versions prior to 10.5 WAS versions prior to 3.5 DASABCIP versions prior to 4.1 SP2 DASSiDirect versions prior to 3.0 DAServer Runtime Components versions prior to 3.0 SP2

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash or hang, via a long Unicode string. This is due to a stack-based buffer overflow in the slssvc.exe component.

Recommendations For Invensys Wonderware SuiteLink versions prior to 58.x, update to version 58.x or later. For InTouch/Wonderware Application Server IT versions prior to 10.5, update to version 10.5 or later. For WAS versions prior to 3.5, update to version 3.5 or later. For DASABCIP versions prior to 4.1 SP2, update to version 4.1 SP2 or later. For DASSiDirect versions prior to 3.0, update to version 3.0 or later. For DAServer Runtime Components versions prior to 3.0 SP2, update to version 3.0 SP2 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-3007

Produtos afetados

Dasabcip

Dassidirect

Daserver Runtime Components

Intouch/Wonderware Application Server It

Invensys Wonderware Suitelink

Was

Referências · 4

• http://securityfocus.com/bid/53563 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3007 · Nota de Segurança
• http://secunia.com/advisories/49173 · Nota
• http://us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf · Nota