PT-2016-6694 · Rockwell Automation · Rslogix Micro Starter Lite+4
Ariele Caltabiano
+1
·
Publicado
2016-09-19
·
Atualizado
2016-11-28
·
CVE-2016-5814
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Rockwell Automation RSLogix Micro Starter Lite (affected versions not specified)
Rockwell Automation RSLogix Micro Developer (affected versions not specified)
Rockwell Automation RSLogix 500 Starter Edition (affected versions not specified)
Rockwell Automation RSLogix 500 Standard Edition (affected versions not specified)
Rockwell Automation RSLogix 500 Professional Edition (affected versions not specified)
Description
The issue allows remote attackers to execute arbitrary code via a crafted RSS project file, due to a buffer overflow in the project file parsing mechanism. This can lead to remote code execution.
Recommendations
For Rockwell Automation RSLogix Micro Starter Lite, update to a version that fixes the buffer overflow issue.
For Rockwell Automation RSLogix Micro Developer, update to a version that fixes the buffer overflow issue.
For Rockwell Automation RSLogix 500 Starter Edition, update to a version that fixes the buffer overflow issue.
For Rockwell Automation RSLogix 500 Standard Edition, update to a version that fixes the buffer overflow issue.
For Rockwell Automation RSLogix 500 Professional Edition, update to a version that fixes the buffer overflow issue.
As a temporary workaround, consider restricting the use of crafted RSS project files until a patch is available.
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Rslogix 500 Professional Edition
Rslogix 500 Standard Edition
Rslogix 500 Starter Edition
Rslogix Micro Developer
Rslogix Micro Starter Lite