PT-2015-4160 · Invensys · Invensys Srd Control Valve Positioner

Published 2015-03-14 · Updated 2016-08-26 · CVE-2014-9206

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Invensys SRD Control Valve Positioner devices versions 3.1.6 and earlier

Description A stack-based buffer overflow issue in the Device Type Manager (DTM) allows local users to gain privileges via a malformed DLL file.

Recommendations For versions 3.1.6 and earlier, update to a version later than 3.1.6 to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-9206

Affected Products

Invensys Srd Control Valve Positioner

References · 3

• http://download.schneider-electric.com/files?p_File_Id=745435959&p_File_Name=SEVD-2015-050-01.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9206 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-055-03 · Note