PT-2011-2279 · Indusoft+1 · Indusoft Web Studio+2

Published 2011-05-04 · Updated 2013-05-21 · CVE-2011-0340

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InduSoft Web Studio versions prior to 7.0+SP1 InduSoft Thin Client version 7.0 Advantech Studio version 6.1 SP6 61.6.01.05

Description The issue allows remote attackers to execute arbitrary code via a long value in certain properties or method arguments, including InternationalOrder, InternationalSeparator, or LogFileName property values, or a long bstrFileName argument to the OpenScreen method.

Recommendations For InduSoft Web Studio versions prior to 7.0+SP1, update to version 7.0+SP1 or later. For InduSoft Thin Client version 7.0, consider disabling the OpenScreen method or restricting access to the ISSymbol ActiveX control until a patch is available. For Advantech Studio version 6.1 SP6 61.6.01.05, restrict the use of long values in the InternationalOrder, InternationalSeparator, or LogFileName properties to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-0340

ZDI-12-155

ZDI-12-168

Affected Products

Advantech Studio

Indusoft Thin Client

Indusoft Web Studio

References · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/indusoft_issymbol_internationalseparator.rb · Exploit
• 🔥 https://exploit-db.com/exploits/23500 · Exploit
• http://secunia.com/advisories/43116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0340 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-12-168 · Security Note
• http://secunia.com/secunia_research/2011-37 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-12-155 · Security Note
• http://secunia.com/advisories/42928 · Vendor Advisory
• http://secunia.com/secunia_research/2011-36 · Vendor Advisory
• http://vupen.com/english/advisories/2011/1116 · Vendor Advisory
• http://vupen.com/english/advisories/2011/1115 · Vendor Advisory
• http://indusoft.com/hotfixes/hotfixes.php · Note
• http://securityfocus.com/bid/47596 · Note
• http://ics-cert.us-cert.gov/advisories/ICSA-12-249-03 · Note
• http://us-cert.gov/control_systems/pdf/ICSA-12-137-02.pdf · Note