PT-2012-5043 · Invensys+1 · Invensys Intouch 2012+1

Published 2012-07-05 · Updated 2012-08-14 · CVE-2012-3847

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Invensys InTouch 2012 Wonderware Application Server 2012

Description The issue allows remote attackers to cause a denial of service due to resource consumption via a long Unicode string.

Recommendations For Invensys InTouch 2012, restrict access to the slssvc.exe service to minimize the risk of exploitation. For Wonderware Application Server 2012, consider implementing input validation to prevent long Unicode strings from being processed by the slssvc.exe service.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2012-3847

Affected Products

Invensys Intouch 2012

Wonderware Application Server 2012

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-3847 · Security Note
• http://secunia.com/advisories/49173 · Note
• http://us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf · Note