PT-2012-4074 · Ge Intelligent Platforms+1 · Ge Intelligent Platforms Si7 I/O Driver+6

Published 2012-07-05 · Updated 2012-07-17 · CVE-2012-2515

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions KeyHelp.ocx version 1.2.312 EMC Documentum ApplicationXtender Desktop version 5.4 EMC Captiva Quickscan Pro version 4.6 SP1 GE Intelligent Platforms Proficy Historian versions 3.1 through 4.5 GE Intelligent Platforms Proficy HMI/SCADA iFIX versions 5.0 through 5.1 GE Intelligent Platforms Proficy Pulse version 1.0 GE Intelligent Platforms Proficy Batch Execution version 5.6 GE Intelligent Platforms SI7 I/O Driver versions 7.20 through 7.42

Description The issue is related to multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control. This can be exploited by remote attackers to execute arbitrary code via a long string in the second argument to the JumpMappedID or JumpURL method.

Recommendations For KeyHelp.ocx version 1.2.312, consider disabling the JumpMappedID and JumpURL methods until a patch is available. For EMC Documentum ApplicationXtender Desktop version 5.4, restrict access to the affected ActiveX control to minimize the risk of exploitation. For EMC Captiva Quickscan Pro version 4.6 SP1, avoid using the JumpMappedID and JumpURL methods in the affected ActiveX control until the issue is resolved. For GE Intelligent Platforms Proficy Historian versions 3.1 through 4.5, temporarily disable the use of the KeyHelp.ocx ActiveX control. For GE Intelligent Platforms Proficy HMI/SCADA iFIX versions 5.0 through 5.1, consider applying configuration changes to restrict access to the vulnerable component. For GE Intelligent Platforms Proficy Pulse version 1.0, restrict access to the affected module to minimize the risk of exploitation. For GE Intelligent Platforms Proficy Batch Execution version 5.6, avoid using the vulnerable function until the issue is resolved. For GE Intelligent Platforms SI7 I/O Driver versions 7.20 through 7.42, consider disabling the affected ActiveX control until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-2515

Affected Products

Emc Captiva Quickscan Pro

Emc Documentum Applicationxtender Desktop

Ge Intelligent Platforms Proficy Batch Execution

Ge Intelligent Platforms Proficy Hmi/Scada Ifix

Ge Intelligent Platforms Proficy Historian

Ge Intelligent Platforms Proficy Pulse

Ge Intelligent Platforms Si7 I/O Driver

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/emc_appextender_keyworks.rb · Exploit
• 🔥 http://securityfocus.com/bid/36546 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_emc_keyhelp.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2515 · Security Note
• http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf · Vendor Advisory
• http://secunia.com/advisories/36905 · Vendor Advisory
• http://secunia.com/advisories/36914 · Vendor Advisory
• http://us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdf · Note
• http://vupen.com/english/advisories/2009/2793 · Note
• http://vupen.com/english/advisories/2009/2795 · Note