PT-2011-3475 · Ge Intelligent Platforms · Proficy Applications

Published 2011-11-02 · Updated 2011-11-17 · CVE-2011-1919

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GE Intelligent Platforms Proficy Applications versions prior to 4.4.1 SIM 101 GE Intelligent Platforms Proficy Applications versions 5.x prior to 5.0 SIM 43

Description The issue is related to multiple stack-based buffer overflows that can be triggered by remote attackers via crafted TCP message traffic. This can lead to a denial of service, causing the daemon to crash, or potentially allow the execution of arbitrary code. The affected components include PRProficyMgr.exe in Proficy Server Manager, PRGateway.exe in Proficy Server Gateway, PRRDS.exe in Proficy Remote Data Service, and PRLicenseMgr.exe in Proficy Server License Manager.

Recommendations For GE Intelligent Platforms Proficy Applications versions prior to 4.4.1 SIM 101, update to version 4.4.1 SIM 101 or later. For GE Intelligent Platforms Proficy Applications versions 5.x prior to 5.0 SIM 43, update to version 5.0 SIM 43 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-1919

Affected Products

Proficy Applications

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-1919 · Security Note
• http://us-cert.gov/control_systems/pdf/ICSA-11-243-01.pdf · Note
• http://securityfocus.com/bid/50474 · Note