Measuresoft ScadaPro Multiple Security Vulnerabilities

Bugtraq ID:	49613
Class:	Unknown
CVE:	CVE-2011-3490 CVE-2011-3495 CVE-2011-3496 CVE-2011-3497
Remote:	Yes
Local:	No
Published:	Sep 13 2011 12:00AM
Updated:	Sep 20 2011 09:30PM
Credit:	Luigi Auriemma
Vulnerable:	Measuresoft ScadaPro 4.0 Measuresoft ScadaPro 0
Not Vulnerable:	Measuresoft ScadaPro 4.0.1

Measuresoft ScadaPro Multiple Security Vulnerabilities

Measuresoft ScadaPro is prone to multiple security vulnerabilities.

Exploiting these issues could allow remote attackers to perform unauthorized actions using directory traversal strings or to execute arbitrary code or commands within the context of the affected application. Failed attempts will likely cause denial-of-service conditions.

Measuresoft ScadaPro Multiple Security Vulnerabilities

Exploit code is available. Please see the references for more information.

The following Metasploit exploit module is available:

• /data/vulnerabilities/exploits/49613.rb

Measuresoft ScadaPro Multiple Security Vulnerabilities

Solution:
The vendor released an update. Please contact the vendor for more information on how to obtain and apply this update.

Measuresoft ScadaPro Multiple Security Vulnerabilities

References:

• Measuresoft ScadaPro Vulnerabilities (Luigi Auriemma)
  
• Product Homepage (Measuresoft)
  
• Re: Vulnerabilities in trading and SCADA softwares ([email protected])
  
• ICSA-11-263-01�??MEASURESOFT SCADAPRO MULTIPLE VULNERABILITIES (ICS-CERT)
  
• Reports of Measuresoft ScadaPro 4.0.0 Vulnerability (Measuresoft)