The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.

The installed version of Advantech WebAccess is prior to 7.2-2013.11.14 and is affected by the following vulnerabilities :

 - Multiple SQL Injection vulnerabilities exist in 'DBVisitor.dll' that can be exploited via specially crafted SOAP requests. (CVE-2014-0763)
 - Multiple stack-based buffer overflow conditions exist in an unspecified ActiveX control. (CVE-2014-0764, CVE-2014-0765, CVE-2014-0766, CVE-2014-0767, CVE-2014-0768)
 - The 'NodeName' parameter on the web interface is affected by a buffer overflow vulnerability. (CVE-2014-0770)
 - An unspecified ActiveX control contains a flaw that allows attackers to read arbitrary files. (CVE-2014-0771, CVE-2014-0772)
 - An unspecified ActiveX control contains a flaw that allows certain executable names to be run from arbitrary path names. (CVE-2014-0773)

The remote host has a version of Advantech WebAccess prior to version 7.2-2013.11.14. It is, therefore, affected by  multiple vulnerabilities :

  - Multiple SQL Injection vulnerabilities exist in     'DBVisitor.dll' that can be exploited via specially     crafted SOAP requests. (CVE-2014-0763)

  - Multiple stack-based buffer overflow conditions exist in     an ActiveX control. (CVE-2014-0764, CVE-2014-0765,     CVE-2014-0766, CVE-2014-0767, CVE-2014-0768)

  - The 'NodeName' parameter on the web interface is     affected by a buffer overflow vulnerability.
    (CVE-2014-0770)

  - A flawed ActiveX control allows attackers to read     arbitrary files. (CVE-2014-0771, CVE-2014-0772)

  - A flawed ActiveX control allows certain executable     names to be run from arbitrary path names.
    (CVE-2014-0773)

The remote host has an ActiveX control (BWOCXRUN.OCX) installed that is affected by multiple vulnerabilities :

  - Multiple methods all allow remote attackers to read     arbitrary files. (CVE-2014-0771, CVE-2014-0772)

  - The CreateProcess method allows certain executable names     to be run from arbitrary path names. (CVE-2014-0773)

ID	Name	Product	Family	Severity
9957	Advantech WebAccess < 7.2-2013.11.14 Multiple Vulnerabilities	Nessus Network Monitor	SCADA	high
85411	Advantech WebAccess < 7.2-2013.11.14 Multiple Vulnerabilities	Nessus	SCADA	high
73641	Advantech WebAccess Multiple BWOCXRUN.OCX ActiveX Vulnerabilities	Nessus	SCADA	high

Detections

Analytics

CVE-2014-0771

high

Tenable Plugins

high

high

high