PT-2013-1694 · Ge Intelligent Platforms · Proficy Process Systems+1

Publicado 2013-01-17 · Atualizado 2013-01-29 · CVE-2012-4689

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions 4.01 through 8.0 Proficy Process Systems with CIMPLICITY versions 4.01 through 8.0

Description The issue is related to an integer overflow in CimWebServer.exe, which can be exploited by remote attackers through a malformed HTTP request, leading to a denial of service (daemon crash).

Recommendations For GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions 4.01 through 8.0, consider restricting access to the CimWebServer.exe until a fix is available. For Proficy Process Systems with CIMPLICITY versions 4.01 through 8.0, avoid using the vulnerable CimWebServer.exe functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2012-4689

Produtos afetados

Proficy Hmi/Scada - Cimplicity

Proficy Process Systems

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4689 · Nota
• http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15153 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4689 · Nota de Segurança
• http://us-cert.gov/control_systems/pdf/ICSA-12-341-01.pdf · Nota