PT-2013-5333 · National Instruments · Labwindows/Cvi+1

Publicado 2013-08-06 · Atualizado 2013-09-18 · CVE-2013-5022

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions National Instruments LabWindows/CVI versions prior to 2012 SP1 National Instruments LabVIEW versions prior to 2012 SP1

Description The issue allows remote attackers to create and execute arbitrary files via a full pathname in an argument to the ExportStyle method, in conjunction with file content in the Caption or FormatString property value. This can be exploited by providing a full pathname in the argument to the ExportStyle method.

Recommendations For National Instruments LabWindows/CVI versions prior to 2012 SP1, update to a version later than 2012 SP1. For National Instruments LabVIEW versions prior to 2012 SP1, update to a version later than 2012 SP1. As a temporary workaround, consider restricting the use of the ExportStyle method until a patch is available. Avoid using the Caption and FormatString property values in the affected ActiveX control until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2013-5022

Produtos afetados

Labview

Labwindows/Cvi

Referências · 4

• http://digital.ni.com/public.nsf/websearch/C4619A438F7E78E486257B360050BD7D?OpenDocument · Aviso do Fabricante
• http://digital.ni.com/public.nsf/allkb/782E4F31442D833186257BD3004AEB47?OpenDocument · Nota
• http://digital.ni.com/public.nsf/websearch/507DEC9DA57A708186257B3600512623?OpenDocument · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-5022 · Nota de Segurança