PT-2019-12127 · Red Lion Controls · Crimson

Anthony Fuller + 2 · Published 2019-09-05 · Updated 2023-03-01 · CVE-2019-10996

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Lion Controls Crimson versions 3.0 and prior Red Lion Controls Crimson version 3.1 prior to release 3112.00

Description The issue allows for exploitation when a valid user opens a specially crafted, malicious input file. This can lead to referencing memory after it has been freed, which is a use-after-free condition. This condition can potentially be used for remote code execution or information disclosure.

Recommendations For Red Lion Controls Crimson versions 3.0 and prior, update to a version later than 3.0 to resolve the issue. For Red Lion Controls Crimson version 3.1 prior to release 3112.00, update to release 3112.00 or later to resolve the issue. As a temporary workaround, consider restricting access to malicious input files until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2019-10996

ZDI-19-783

ZDI-19-787

ZDI-19-788

ZDI-19-797

Affected Products

Crimson

References · 7

• https://zerodayinitiative.com/advisories/ZDI-19-788 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10996 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10996 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-783 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-787 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-797 · Security Note
• https://us-cert.gov/ics/advisories/icsa-19-248-01 · Note