PT-2013-5332 · Abb+1 · Data Manager+2

Andrea Micalizzi + 1 · Published 2013-06-11 · Updated 2013-09-18 · CVE-2013-5021

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions National Instruments LabWindows/CVI versions prior to 2012 SP1 National Instruments LabVIEW versions prior to 2012 SP1 ABB DataManager versions 1 through 6.3.6

Description The issue allows remote attackers to create and execute arbitrary files via a full pathname in an argument to the ExportStyle method in various ActiveX controls, including CWNumEdit, CWGraph, CWBoolean, CWSlide, or CWKnob, in conjunction with file content in the Caption or FormatString property value.

Recommendations For National Instruments LabWindows/CVI versions prior to 2012 SP1, update to a version later than 2012 SP1. For National Instruments LabVIEW versions prior to 2012 SP1, update to a version later than 2012 SP1. For ABB DataManager versions 1 through 6.3.6, consider disabling the ExportStyle method in the affected ActiveX controls as a temporary workaround until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-5021

ZDI-13-120

Affected Products

Data Manager

Labview

Labwindows/Cvi

References · 6

• https://zerodayinitiative.com/advisories/ZDI-13-120 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-5021 · Security Note
• http://digital.ni.com/public.nsf/websearch/507DEC9DA57A708186257B3600512623?OpenDocument · Note
• http://zerodayinitiative.com/advisories/ZDI-13-120 · Note
• http://www05.abb.com/global/scot/scot203.nsf/veritydisplay/5975a8a86c82eec2c125798e00551522/%24file/SECURITY_BULLETIN_-_ABBVU-PACT-3BSE072617_DataManager_Vulnerability.pdf · Note
• http://digital.ni.com/public.nsf/allkb/04B876608790082C86257BD1000CC950?OpenDocument · Note