PT-2013-5333 · National Instruments · Labwindows/Cvi+1

Published 2013-08-06 · Updated 2013-09-18 · CVE-2013-5022

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions National Instruments LabWindows/CVI versions prior to 2012 SP1 National Instruments LabVIEW versions prior to 2012 SP1

Description The issue allows remote attackers to create and execute arbitrary files via a full pathname in an argument to the ExportStyle method, in conjunction with file content in the Caption or FormatString property value. This can be exploited by providing a full pathname in the argument to the ExportStyle method.

Recommendations For National Instruments LabWindows/CVI versions prior to 2012 SP1, update to a version later than 2012 SP1. For National Instruments LabVIEW versions prior to 2012 SP1, update to a version later than 2012 SP1. As a temporary workaround, consider restricting the use of the ExportStyle method until a patch is available. Avoid using the Caption and FormatString property values in the affected ActiveX control until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-5022

Affected Products

Labview

Labwindows/Cvi

References · 4

• http://digital.ni.com/public.nsf/websearch/C4619A438F7E78E486257B360050BD7D?OpenDocument · Vendor Advisory
• http://digital.ni.com/public.nsf/websearch/507DEC9DA57A708186257B3600512623?OpenDocument · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5022 · Security Note
• http://digital.ni.com/public.nsf/allkb/782E4F31442D833186257BD3004AEB47?OpenDocument · Note