PT-2019-12108 · Emerson · Ovation Ocr400 Controller

Published 2019-05-28 · Updated 2020-10-01 · CVE-2019-10967

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emerson Ovation OCR400 Controller versions 3.3.1 and earlier

Description A stack-based buffer overflow issue in the embedded third-party FTP server is caused by improper handling of long file names from the LIST command to the FTP service. This may cause the service to overwrite buffers, potentially leading to remote code execution and escalation of privileges.

Recommendations For versions 3.3.1 and earlier, update to a version later than 3.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the FTP service until a patch is available.

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

CVE-2019-10967

Affected Products

Ovation Ocr400 Controller

References · 4

• https://osv.dev/vulnerability/CVE-2019-10967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10967 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01 · Note
• http://securityfocus.com/bid/108499 · Note