PT-2023-29793 · National Instruments · Ni System Configuration

CVE-2023-4601 · Publicado 2023-10-18 · Atualizado 2023-10-28

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NI System Configuration versions prior to 2023 Q3

Description A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Successful exploitation requires that an attacker can provide a specially crafted response.

Recommendations For versions prior to 2023 Q3, update to a version newer than 2023 Q3 to resolve the issue. As a temporary workaround, consider restricting access to the NI System Configuration to minimize the risk of exploitation.

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

CVE-2023-4601

ZDI-23-1568

Produtos afetados

Ni System Configuration

Referências · 9

• https://ni.com/en/support/documentation/supplemental/23/stack-based-buffer-overflow-in-ni-system-configuration.html · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-23-1568 · Nota de Segurança
• https://twitter.com/TheZDIBugs/status/1715018557757506031 · Publicação no Twitter
• https://t.me/cibsecurity/72538 · Publicação no Telegram
• https://twitter.com/cracbot/status/1715064573454164263 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4601 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1714770037314126091 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4601 · Nota de Segurança
• https://twitter.com/CVEnew/status/1714724140744053074 · Publicação no Twitter