PT-2012-1201 · Schneider Electric+1 · Citectscada+1

Published 2012-09-15 · Updated 2019-09-15 · CVE-2011-5163

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CitectSCADA versions prior to 7.20 Mitsubishi MX4 SCADA versions prior to 7.20

Description The issue is caused by a buffer overflow in an unspecified third-party component in the Batch module, allowing local users to execute arbitrary code via a long string in a login sequence. This can be exploited by an attacker using a long string, potentially leading to the execution of arbitrary code.

Recommendations For CitectSCADA versions prior to 7.20, update to version 7.20 or later to resolve the issue. For Mitsubishi MX4 SCADA versions prior to 7.20, update to version 7.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the login sequence to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-03753

CVE-2011-5163

Affected Products

Citectscada

Mitsubishi Mx4 Scada

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2011-5163 · Security Note
• https://bdu.fstec.ru/vul/2019-03753 · Security Note
• http://secunia.com/advisories/46786 · Vendor Advisory
• http://secunia.com/advisories/46779 · Vendor Advisory
• https://securityfocus.com/bid/77854 · Note
• http://citect.com/citectscada-batch · Note
• http://osvdb.org/76937 · Note
• http://us-cert.gov/control_systems/pdf/ICSA-11-279-02.pdf · Note
• https://my.mitsubishi-automation.com/downloads_show.php?portal_id=1&doc_type=safety&scat=2&sstr=MX4%2CSCADA · Note
• http://securitytracker.com/id?1026306 · Note