PT-2018-14277 · Delta Industrial Automation · Tpeditor

Ariele Caltabiano + 2 · Published 2018-10-11 · Updated 2019-10-09 · CVE-2018-17927

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Industrial Automation TPEditor versions 1.90 and prior

Description The issue is related to multiple out-of-bounds write vulnerabilities that can be exploited by processing specially crafted project files. These files lack user input validation, which may cause the system to write outside the intended buffer area and may allow remote code execution.

Recommendations For versions 1.90 and prior, update to a version later than 1.90 to resolve the issue. As a temporary workaround, consider restricting the processing of project files from untrusted sources until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-17927

ZDI-18-1235

ZDI-18-1237

ZDI-18-1239

ZDI-18-1245

Affected Products

Tpeditor

References · 8

• https://osv.dev/vulnerability/CVE-2018-17927 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-1239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-17927 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1237 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1235 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1245 · Security Note
• http://securityfocus.com/bid/105682 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-284-03 · Note