PT-2012-1790 · Invensys+1 · Invensys Wonderware Hmi Reports+1

Published 2012-02-10 · Updated 2012-02-14 · CVE-2011-4039

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Invensys Wonderware HMI Reports versions 3.42.835.0304 and earlier Ocean Data Systems Dream Report versions prior to 4.0

Description The issue allows user-assisted remote attackers to execute arbitrary code via a malformed file, triggering a "write access violation."

Recommendations For Invensys Wonderware HMI Reports versions 3.42.835.0304 and earlier, update to a version later than 3.42.835.0304 to resolve the issue. For Ocean Data Systems Dream Report versions prior to 4.0, update to version 4.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-4039

Affected Products

Dream Report

Invensys Wonderware Hmi Reports

References · 5

• http://secunia.com/advisories/47742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4039 · Security Note
• http://secunia.com/advisories/47933 · Vendor Advisory
• http://us-cert.gov/control_systems/pdf/ICSA-12-039-01.pdf · Note
• http://us-cert.gov/control_systems/pdf/ICSA-12-024-01.pdf · Note