IniNet Solutions SCADA Web Server < 2.02.0000

critical Nessus Network Monitor Plugin ID 9011

Synopsis

The remote host is running a version of IniNet Solutions SCADA Web Server that has multiple vulnerabilities.

Description

The remote host is running the IniNet Solutions SCADA Web Server that is subject to the following vulnerabilities :

- An overflow condition exists in an unspecified function. The issue is triggered as user-supplied input is not properly validated when handling multiple fields in HTTP requests. This may allow a remote attacker to cause a stack-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2015-1001)
- A flaw exists that is triggered when handling input that has been URL encoded. This may allow an unauthorized attacker to make changes to arbitrary files. (CVE-2015-1002)
- A flaw exists that allows traversing outside of a restricted path. The issue is due to the progam not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can gain access to arbitrary files. (CVE-2015-1003)

Solution

Upgrade to version 2.02.0000 or later.

Plugin Details

Severity: Critical

ID: 9011

Family: SCADA

Published: 11/24/2015

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ininet_solutions_gmbh:ininet_scada_web_server

Reference Information

CVE: CVE-2015-1001, CVE-2015-1002, CVE-2015-1003

Detections

Analytics