InduSoft NTWebServer Web Service Stack-Based Buffer Overflow Vulnerability
BID:45783
Info
InduSoft NTWebServer Web Service Stack-Based Buffer Overflow Vulnerability
| Bugtraq ID: | 45783 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2011-0488 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 12 2011 12:00AM |
| Updated: | Aug 19 2011 05:10PM |
| Credit: | Jeremy Brown |
| Vulnerable: |
Indusoft Web Studio 6.1 Advantech Indusoft 6.1 |
| Not Vulnerable: | |
Discussion
InduSoft NTWebServer Web Service Stack-Based Buffer Overflow Vulnerability
InduSoft NTWebServer is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code in the context of the affected server. Successful attacks will compromise the server and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions.
InduSoft NTWebServer is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code in the context of the affected server. Successful attacks will compromise the server and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions.
Exploit / POC
InduSoft NTWebServer Web Service Stack-Based Buffer Overflow Vulnerability
A commercial exploit is available through the GLEG Agora SCADA+ exploit pack. This exploit is not otherwise publicly available or known to be circulating in the wild.
A commercial exploit is available through the GLEG Agora SCADA+ exploit pack. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
InduSoft NTWebServer Web Service Stack-Based Buffer Overflow Vulnerability
Solution:
The vendor released an update. Please see the references for details.
Solution:
The vendor released an update. Please see the references for details.
References
InduSoft NTWebServer Web Service Stack-Based Buffer Overflow Vulnerability
References:
References:
- Vendor Homepage (InduSoft)
- Vulnerability Note VU#506864 (US-CERT)
- ICS-CERT ALERT "ICS-ALERT-11-230-01 - AGORA SCADA+ Update 1.4" (ICS-CERT)