Detections
Analytics

Sielco Sistemi Winlog < 2.07.18 Multiple Vulnerabilities

high Nessus Plugin ID 61494

Language:

Synopsis

A SCADA application on the remote host is affected by multiple vulnerabilities.

Description

The remote host has a version of Sielco Sistemi Winlog prior to 2.07.18 that is affected by the following vulnerabilities:

 - A buffer overflow vulnerability exists in RunTime.exe could allow an attacker to execute arbitrary code on the remote host. It can be triggered by sending specially crafted packets to port 46824. (CVE-2012-3815)

 - There are multiple buffer overflows that can be triggered by sending a specially crafted packet with a negative integer after an opcode to port 46824. This may give attackers the ability to execute arbitrary code. (CVE-2012-4355, CVE-2012-4358)

Solution

Upgrade to WinLog 2.07.18 or later.

See Also

http://aluigi.altervista.org/adv/winlog_2-adv.txt

Plugin Details

Severity: High

ID: 61494

File Name: scada_winlog_2_07_18.nbin

Version: 1.68

Type: local

Family: SCADA

Published: 8/10/2012

Updated: 5/20/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2012-4359

Vulnerability Information

CPE: cpe:/a:sielcosistemi:winlog_lite

Required KB Items: SCADA/Apps/Sielco_Sistemi/Winlog/Installed

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/31/2012

Vulnerability Publication Date: 6/26/2012

Exploitable With

Metasploit (Sielco Sistemi Winlog Buffer Overflow 2.07.14 - 2.07.16)

Reference Information

CVE: CVE-2012-3815, CVE-2012-4355, CVE-2012-4359

BID: 53811, 54212

ICS-ALERT: 12-179-01

ICSA: 12-213-01