PT-2016-5980 · Panasonic · Panasonic Fpwin Pro

Steven Seeley · Publicado 2016-05-11 · Atualizado 2016-11-28 · CVE-2016-4497

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Panasonic FPWIN Pro versions 5.x through 7.x before 7.130

Description The issue allows local users to cause a denial of service or possibly have unspecified other impact. It is related to "type confusion" and can be leveraged via certain vectors. There is also a mention of a Type Confusion Remote Code Execution Vulnerability, but details about real-world incidents or the estimated number of potentially affected devices are not provided.

Recommendations For versions 5.x through 7.x before 7.130, update to version 7.130 or later to resolve the issue. As a temporary workaround, consider restricting access to the DeleteAndCreateSysRegDecls And SaveSysRegDeclsDatabaseIdsToTheSysRegDeclInfoMap function until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-4497

ZDI-16-334

Produtos afetados

Panasonic Fpwin Pro

Referências · 5

• http://zerodayinitiative.com/advisories/ZDI-16-334 · Nota
• https://zerodayinitiative.com/advisories/ZDI-16-334 · Nota de Segurança
• http://securityfocus.com/bid/90523 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4497 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-16-131-01 · Nota