PT-2014-3814 · Ge Intelligent Platforms · Proficy Process Systems+1

Publicado 2014-01-25 · Atualizado 2014-02-21 · CVE-2014-0751

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions prior to 8.2 SIM 24 Proficy Process Systems with CIMPLICITY versions prior to 8.2 SIM 24

Description The issue allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212. This is related to a directory traversal vulnerability in the CimWebServer.exe component, also known as the WebView component.

Recommendations For GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions prior to 8.2 SIM 24, update to version 8.2 SIM 24 or later. For Proficy Process Systems with CIMPLICITY versions prior to 8.2 SIM 24, update to version 8.2 SIM 24 or later.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-0751

ZDI-14-016

Produtos afetados

Proficy Hmi/Scada - Cimplicity

Proficy Process Systems

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2014-0751 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-14-023-01 · Nota
• http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940 · Aviso do Fabricante
• http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 · Nota
• http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 · Nota
• http://securityfocus.com/bid/65124 · Nota
• http://securityfocus.com/bid/65117 · Nota
• https://zerodayinitiative.com/advisories/ZDI-14-016 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0751 · Nota