PT-2014-2034 · Yokogawa · Centum Vp+5
Publicado
2014-07-10
·
Atualizado
2020-10-02
·
CVE-2014-3888
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
Yokogawa CENTUM CS 1000 versions prior to R3.09.50
Yokogawa CENTUM CS 3000 versions prior to R3.09.50
Yokogawa CENTUM VP versions prior to R5.03.20
Yokogawa Exaopc versions prior to R3.72.00
Yokogawa B/M9000CS versions prior to R5.05.01
Yokogawa B/M9000 VP versions prior to R7.03.01
Description
The issue is related to a stack-based buffer overflow in the BKFSim vhfd.exe service, which can be exploited by sending a crafted packet to port 20010/UDP. This allows remote attackers to execute arbitrary code when the FCS/Test Function is enabled.
Recommendations
For Yokogawa CENTUM CS 1000 versions prior to R3.09.50, update to a version later than R3.09.50.
For Yokogawa CENTUM CS 3000 versions prior to R3.09.50, update to a version later than R3.09.50.
For Yokogawa CENTUM VP versions prior to R5.03.20, update to a version later than R5.03.20.
For Yokogawa Exaopc versions prior to R3.72.00, update to a version later than R3.72.00.
For Yokogawa B/M9000CS versions prior to R5.05.01, update to a version later than R5.05.01.
For Yokogawa B/M9000 VP versions prior to R7.03.01, update to a version later than R7.03.01.
As a temporary workaround, consider disabling the FCS/Test Function until a patch is available. Restrict access to port 20010/UDP to minimize the risk of exploitation.
Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
B/M9000 Vp
B/M9000Cs
Centum Cs 1000
Centum Cs 3000
Centum Vp
Exaopc