PT-2011-2281 · Indusoft · Indusoft Web Studio

Dmitry Pletnev · Published 2011-09-02 · Updated 2013-05-21 · CVE-2011-0342

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions InduSoft Web Studio version 7.0B2 hotfix 7.0.01.04

Description The issue concerns multiple buffer overflows in the InduSoft ISSymbol ActiveX control. These overflows can be triggered by passing a long parameter to specific methods, allowing remote attackers to execute arbitrary code. The affected methods include the Open(), Close(), and SetCurrentLanguage() functions.

Recommendations For InduSoft Web Studio version 7.0B2 hotfix 7.0.01.04, consider disabling the ISSymbol ActiveX control until a patch is available to prevent exploitation through the Open(), Close(), and SetCurrentLanguage() methods. Restrict access to these methods to minimize the risk of arbitrary code execution.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-0342

Affected Products

Indusoft Web Studio

References · 6

• http://secunia.com/advisories/44875 · Vendor Advisory
• http://secunia.com/secunia_research/2011-61 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0342 · Security Note
• http://indusoft.com/hotfixes/hotfixes.php · Note
• http://ics-cert.us-cert.gov/advisories/ICSA-11-273-02 · Note
• http://securityfocus.com/bid/49403 · Note