PT-2016-6686 · Fatek Automation · Fatek Automation Fv Designer+1

Ariele Caltabiano + 1 · Publicado 2016-12-14 · Atualizado 2017-02-17 · CVE-2016-5798

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fatek Automation PM Designer version 2.1.2.2 Fatek Automation FV Designer version 1.2.8.0

Description An issue allows an attacker to trigger a stack-based buffer overflow by sending additional valid packets, potentially causing a crash. Additionally, a malicious attacker can trigger a remote buffer overflow on the Fatek Communication Server.

Recommendations For Fatek Automation PM Designer version 2.1.2.2, consider disabling the communication server functionality until a patch is available. For Fatek Automation FV Designer version 1.2.8.0, restrict access to the vulnerable communication server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-5798

ZDI-16-634

Produtos afetados

Fatek Automation Fv Designer

Fatek Communication Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-5798 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-16-634 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-5798 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-16-287-06 · Nota
• http://securityfocus.com/bid/93105 · Nota