PT-2019-7163 · Opto 22 · Pac Project Basic+5

Ivan Sanchez · Publicado 2019-03-25 · Atualizado 2019-10-09 · CVE-2015-1007

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Opto 22 PAC Project Professional versions prior to R9.4008 PAC Project Basic versions prior to R9.4008 PAC Display Basic versions prior to R9.4g PAC Display Professional versions prior to R9.4g OptoOPCServer version R9.4c and prior OptoDataLink version R9.4d and prior

Description A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution.

Recommendations For Opto 22 PAC Project Professional versions prior to R9.4008, upgrade to version R9.4008 or later. For PAC Project Basic versions prior to R9.4008, upgrade to version R9.4008 or later. For PAC Display Basic versions prior to R9.4g, upgrade to version R9.4g or later. For PAC Display Professional versions prior to R9.4g, upgrade to version R9.4g or later. For OptoOPCServer version R9.4c and prior, upgrade to a version later than R9.4c. For OptoDataLink version R9.4d and prior, upgrade to a version later than R9.4d.

Correção

Stack Overflow

Buffer Overflow

Enumeração de Fraquezas

CWE-121

CWE-119

Identificadores relacionados

CVE-2015-1007

Produtos afetados

Opto 22 Pac Project Professional

Optodatalink

Optoopcserver

Pac Display Basic

Pac Display Professional

Pac Project Basic

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-1007 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01 · Nota