Multiple Schneider Electric Products UnitelWay Device Driver Privilege Escalation Vulnerability

Bugtraq ID:	50319
Class:	Input Validation Error
CVE:	CVE-2011-3330
Remote:	No
Local:	Yes
Published:	Oct 20 2011 12:00AM
Updated:	Mar 19 2015 09:31AM
Credit:	Kuang-Chun Hung of Security Research and Service Institute - Information and Communication Security Technology Center (ICST).
Vulnerable:	Schneider Electric Vijeo Citect 7.20 Schneider Electric Unity Pro 6.0 Schneider Electric Telemecanique Driver 2.6 Schneider Electric PL7 Pro 4.5 Schneider Electric OPC Factory Driver 3.34 Schneider Electric Monitor 7.6
Not Vulnerable:

Multiple Schneider Electric Products UnitelWay Device Driver Privilege Escalation Vulnerability

Multiple Schneider Electric products are prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to execute arbitrary code with elevated privileges, which may facilitate a complete compromise of the affected computer.

The following applications are vulnerable:

Vijeo Citect 7.20 and prior versions
OPC Factory Server 3.34
Telemecanique Driver Pack 2.6 and prior versions
Unity Pro 6.0 and prior versions
Monitor 7.6 and prior versions
PL7 Pro 4.5 SP5 and prior versions

Multiple Schneider Electric Products UnitelWay Device Driver Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Schneider Electric Products UnitelWay Device Driver Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.

Multiple Schneider Electric Products UnitelWay Device Driver Privilege Escalation Vulnerability

References:

• Schneider Electric Homepage (Schneider Electric)
  
• ICSA-11-277-01 (US-CERT)
  
• Important security notification �?? Vulnerability within UnitelWay Windows Device (Schneider Electric)