PT-2019-12108 · Emerson · Ovation Ocr400 Controller

Publicado 2019-05-28 · Atualizado 2020-10-01 · CVE-2019-10967

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emerson Ovation OCR400 Controller versions 3.3.1 and earlier

Description A stack-based buffer overflow issue in the embedded third-party FTP server is caused by improper handling of long file names from the LIST command to the FTP service. This may cause the service to overwrite buffers, potentially leading to remote code execution and escalation of privileges.

Recommendations For versions 3.3.1 and earlier, update to a version later than 3.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the FTP service until a patch is available.

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

CVE-2019-10967

Produtos afetados

Ovation Ocr400 Controller

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01 · Nota
• https://osv.dev/vulnerability/CVE-2019-10967 · Aviso do Fabricante
• http://securityfocus.com/bid/108499 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10967 · Nota de Segurança