PT-2012-5043 · Invensys+1 · Invensys Intouch 2012+1

Publicado 2012-07-05 · Atualizado 2012-08-14 · CVE-2012-3847

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Invensys InTouch 2012 Wonderware Application Server 2012

Description The issue allows remote attackers to cause a denial of service due to resource consumption via a long Unicode string.

Recommendations For Invensys InTouch 2012, restrict access to the slssvc.exe service to minimize the risk of exploitation. For Wonderware Application Server 2012, consider implementing input validation to prevent long Unicode strings from being processed by the slssvc.exe service.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2012-3847

Produtos afetados

Invensys Intouch 2012

Wonderware Application Server 2012

Referências · 3

• http://secunia.com/advisories/49173 · Nota
• http://us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3847 · Nota de Segurança