PT-2016-5997 · Unitronics · Visilogic Oplc Ide

Steven Seeley · Published 2016-06-24 · Updated 2016-11-28 · CVE-2016-4519

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unitronics VisiLogic OPLC IDE versions prior to 9.8.30

Description The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by crafting a filename field in a ZIP archive within a vlp file. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For versions prior to 9.8.30, update to version 9.8.30 or later to resolve the issue. As a temporary workaround, consider restricting the handling of vlp files and ZIP archives to minimize the risk of exploitation. Avoid using crafted filename fields in ZIP archives within vlp files until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-4519

ZDI-16-375

Affected Products

Visilogic Oplc Ide

References · 6

• https://osv.dev/vulnerability/CVE-2016-4519 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-16-375 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-4519 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-16-375 · Vendor Advisory
• http://securityfocus.com/bid/91402 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-175-02 · Note