PT-2016-5997 · Unitronics · Visilogic Oplc Ide

Steven Seeley · Publicado 2016-06-24 · Atualizado 2016-11-28 · CVE-2016-4519

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unitronics VisiLogic OPLC IDE versions prior to 9.8.30

Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by crafting a filename field in a ZIP archive within a vlp file. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For versions prior to 9.8.30, update to version 9.8.30 or later to resolve the issue. As a temporary workaround, consider restricting the handling of vlp files and ZIP archives to minimize the risk of exploitation. Avoid using crafted filename fields in ZIP archives within vlp files until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-4519

ZDI-16-375

Produtos afetados

Visilogic Oplc Ide

Referências · 6

• https://osv.dev/vulnerability/CVE-2016-4519 · Aviso do Fabricante
• http://securityfocus.com/bid/91402 · Nota
• https://zerodayinitiative.com/advisories/ZDI-16-375 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-4519 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-16-375 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-16-175-02 · Nota