PT-2016-6686 · Fatek Automation · Fatek Automation Fv Designer+1

Ariele Caltabiano + 1 · Published 2016-12-14 · Updated 2017-02-17 · CVE-2016-5798

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fatek Automation PM Designer version 2.1.2.2 Fatek Automation FV Designer version 1.2.8.0

Description An issue allows an attacker to trigger a stack-based buffer overflow by sending additional valid packets, potentially causing a crash. Additionally, a malicious attacker can trigger a remote buffer overflow on the Fatek Communication Server.

Recommendations For Fatek Automation PM Designer version 2.1.2.2, consider disabling the communication server functionality until a patch is available. For Fatek Automation FV Designer version 1.2.8.0, restrict access to the vulnerable communication server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-5798

ZDI-16-634

Affected Products

Fatek Automation Fv Designer

Fatek Communication Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-5798 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-634 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5798 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-287-06 · Note
• http://securityfocus.com/bid/93105 · Note