PT-2011-4391 · Schneider Electric+1 · Unitelway Windows Device Driver+6

Published 2011-11-04 · Updated 2017-08-29 · CVE-2011-3330

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Unity Pro versions 6 and earlier OPC Factory Server version 3.34 Vijeo Citect versions 7.20 and earlier Telemecanique Driver Pack versions 2.6 and earlier Monitor Pro versions 7.6 and earlier PL7 Pro versions 4.5 and earlier

Description A buffer overflow issue exists in the UnitelWay Windows Device Driver. This allows local users, and possibly remote attackers, to execute arbitrary code via an unspecified system parameter.

Recommendations For Unity Pro versions 6 and earlier, update to a version later than 6. For OPC Factory Server version 3.34, update to a version later than 3.34. For Vijeo Citect versions 7.20 and earlier, update to a version later than 7.20. For Telemecanique Driver Pack versions 2.6 and earlier, update to a version later than 2.6. For Monitor Pro versions 7.6 and earlier, update to a version later than 7.6. For PL7 Pro versions 4.5 and earlier, update to a version later than 4.5.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-3330

Affected Products

Monitor Pro

Opc Factory Server

Pl7 Pro

Telemecanique Driver Pack

Unitelway Windows Device Driver

Unity Pro

Vijeo Citect

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-3330 · Security Note
• http://secunia.com/advisories/46534 · Vendor Advisory
• http://scada.schneider-electric.com/sites/scada/en/login/vijeo-citect-unitelway-windows-device-driver.page · Vendor Advisory
• http://us-cert.gov/control_systems/pdf/ICSA-11-277-01.pdf · Note
• http://securityfocus.com/bid/50319 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70882 · Note
• http://securitytracker.com/id?1026234 · Note