PT-2015-4038 · Schneider Electric · Vampset

Published 2015-04-03 · Updated 2018-10-09 · CVE-2014-8390

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Schneider Electric VAMPSET versions prior to 2.2.168

Description The issue concerns multiple buffer overflows that can be triggered by local users through malformed disturbance-recording data in a CFG or DAT file, potentially allowing them to gain privileges.

Recommendations For versions prior to 2.2.168, update to version 2.2.168 or later to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-8390

Affected Products

Vampset

References · 6

• 🔥 http://coresecurity.com/advisories/schneider-vampset-stack-and-heap-buffer-overflow · Exploit
• http://schneider-electric.com/ww/en/download/document/SEVD-2015-084-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8390 · Security Note
• http://securityfocus.com/archive/1/535142/100/0/threaded · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-092-01 · Note
• http://securityfocus.com/bid/73405 · Note