PT-2016-1122 · Advantech · Advantech Webaccess
Publicado
2016-01-15
·
Atualizado
2016-12-03
·
CVE-2016-0856
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Advantech WebAccess versions prior to 8.1
Description
The issue is caused by multiple stack-based buffer overflows in Advantech WebAccess. Exploitation of these overflows may allow a remote attacker to execute arbitrary code. The overflows occur in various services and components, including datacore.exe and webvrpcs services, and involve functions such as strcpy, sprintf, and strcat, affecting parameters like
Path, ProjectName, HostName, NodeName, TagName, WindowName, and Username.Recommendations
For Advantech WebAccess versions prior to 8.1, update to version 8.1 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable services, such as datacore and webvrpcs, until a patch is applied.
Avoid using vulnerable functions like
strcpy() and sprintf() in the affected components until the issue is resolved.
Restrict input to parameters like Path, ProjectName, HostName, NodeName, TagName, WindowName, and Username to minimize the risk of exploitation.Exploit
Correção
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Advantech Webaccess