PT-2012-5556 · Invensys · Invensys Wonderware Intouch

Publicado 2012-12-18 · Atualizado 2012-12-19 · CVE-2012-4693

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Invensys Wonderware InTouch versions 2012 R2 and earlier

Description The issue concerns the use of a weak encryption algorithm for data stored in the Ps security.ini file. This weakness makes it easier for local users to discover passwords by reading this file.

Recommendations For Invensys Wonderware InTouch versions 2012 R2 and earlier, consider restricting access to the Ps security.ini file to minimize the risk of password discovery until a stronger encryption algorithm is implemented.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-4693

Produtos afetados

Invensys Wonderware Intouch

Referências · 3

• http://us-cert.gov/control_systems/pdf/ICSA-12-348-01.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4693 · Nota de Segurança
• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-370812.pdf · Aviso do Fabricante