PT-2013-1315 · Citect+1 · Citectscada+2

Dr_Ide · Published 2013-04-19 · Updated 2019-03-25 · CVE-2013-3075

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi MX Component 3 versions 1.0.0.1 Citect CitectFacilities version 7.10 CitectScada version 7.10r1

Description The issue is caused by multiple buffer overflows in the ActUWzd.dll library, which allows remote attackers to execute arbitrary code via a long string. This can be demonstrated by a long WzTitle property value to a certain ActiveX control. The exploitation of this issue may enable a remote attacker to execute arbitrary code using a long string.

Recommendations For Mitsubishi MX Component 3 version 1.0.0.1, consider disabling the use of the ActUWzd.dll library until a patch is available. For Citect CitectFacilities version 7.10, restrict access to the affected ActiveX control to minimize the risk of exploitation. For CitectScada version 7.10r1, avoid using long string values for the WzTitle property in the affected ActiveX control until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-03750

CVE-2013-3075

Affected Products

Citectfacilities

Citectscada

Mitsubishi Mx Component 3

References · 4

• 🔥 https://exploit-db.com/exploits/24886 · Exploit
• 🔥 http://exploit-db.com/exploits/24886 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3075 · Security Note
• https://bdu.fstec.ru/vul/2019-03750 · Security Note