PT-2008-3526 · Wonderware · Wonderware Intouch+1

Belay Tows · Published 2008-05-06 · Updated 2018-10-11 · CVE-2008-2005

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions WonderWare SuiteLink versions prior to 2.0 Patch 01 WonderWare InTouch version 8.0

Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413. This causes a memory allocation failure, resulting in a NULL pointer dereference and service shutdown.

Recommendations For WonderWare SuiteLink versions prior to 2.0 Patch 01, apply Patch 01 to resolve the issue. For WonderWare InTouch version 8.0, ensure that the underlying SuiteLink Service is updated to a version that includes the fix, such as SuiteLink 2.0 Patch 01.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-2005

Affected Products

Wonderware Intouch

Wonderware Suitelink

References · 9

• 🔥 https://exploit-db.com/exploits/6474 · Exploit
• 🔥 http://coresecurity.com/?action=item&id=2187 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2005 · Security Note
• http://securityfocus.com/archive/1/491623/100/0/threaded · Note
• http://securitytracker.com/id?1019966 · Note
• http://secunia.com/advisories/30063 · Note
• http://securityfocus.com/bid/28974 · Note
• http://kb.cert.org/vuls/id/596268 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42221 · Note