PT-2016-3264 · Mitsubishi · Mitsubishi E-Designer

Rgod · Published 2016-06-01 · Updated 2019-10-09 · CVE-2017-9634

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitsubishi E-Designer version 7.52 Build 344

Description The issue is related to a buffer overflow in memory when processing certain sections of a project file (.mpa), which can be exploited to allow an attacker to overwrite arbitrary memory locations. This can result in arbitrary code execution, compromised data integrity, denial of service, and system crash. An attacker can exploit this issue remotely by using a specially crafted file or web page, potentially allowing them to execute code as an administrator or cause a denial of service.

Recommendations For Mitsubishi E-Designer version 7.52 Build 344, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2018-00778

CVE-2017-9634

ZDI-17-506

ZDI-17-507

Affected Products

Mitsubishi E-Designer

References · 8

• https://bdu.fstec.ru/vul/2018-00778 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-506 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9634 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-507 · Security Note
• http://securityfocus.com/bid/100097 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-213-01 · Note
• https://securitylab.ru/news/487659.php · Note