PT-2018-2002 · Omron · Omron Cx-One+2
Publicado
2018-12-04
·
Atualizado
2020-09-18
·
CVE-2018-18993
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Omron CX-One versions 4.42 and prior
Omron CX-Programmer versions 9.66 and prior
Omron CX-Server versions 5.0.23 and prior
Description
The issue is caused by a stack-based buffer overflow in the Omron CX-Programmer development environment, which is part of the Omron CX-One software suite. This overflow can occur when processing project files, allowing input data to exceed the buffer. An attacker could exploit this by using a specially crafted project file to overflow the buffer and execute arbitrary code under the privileges of the application.
Recommendations
For Omron CX-One versions 4.42 and prior, update to a version later than 4.42 to resolve the issue.
For Omron CX-Programmer versions 9.66 and prior, update to a version later than 9.66 to resolve the issue.
For Omron CX-Server versions 5.0.23 and prior, update to a version later than 5.0.23 to resolve the issue.
As a temporary workaround, consider restricting the use of project files from untrusted sources to minimize the risk of exploitation.
Correção
Stack Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Omron Cx-One
Omron Cx-Programmer
Omron Cx-Server