Sielco Sistemi Winlog Pro Multiple Security Vulnerabilities

Bugtraq ID:	54212
Class:	Unknown
CVE:	CVE-2012-4353 CVE-2012-4354 CVE-2012-4355 CVE-2012-4356 CVE-2012-4357 CVE-2012-4358 CVE-2012-4359
Remote:	Yes
Local:	No
Published:	Jun 26 2012 12:00AM
Updated:	Mar 19 2015 08:22AM
Credit:	Luigi Auriemma
Vulnerable:	SIELCO SISTEMI Winlog Pro 2.7.9 SIELCO SISTEMI Winlog Pro 2.7.1 SIELCO SISTEMI Winlog Pro 2.7
Not Vulnerable:

Sielco Sistemi Winlog Pro Multiple Security Vulnerabilities

Winlog Pro is prone to the following security vulnerabilities:

1. Multiple code-execution vulnerabilities.

2. A stack-based buffer-overflow vulnerability.

3. A directory-traversal vulnerability.

Attackers can leverage these issues to perform unauthorized actions through directory traversal attacks, run arbitrary code, or cause a denial of service. Other attacks may also be possible.

Winlog Pro 2.07.16 and prior are vulnerable.

Sielco Sistemi Winlog Pro Multiple Security Vulnerabilities

A proof of concept codes are available from the discoverer of these issues. Please see the references for more information.

Sielco Sistemi Winlog Pro Multiple Security Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

Sielco Sistemi Winlog Pro Multiple Security Vulnerabilities

References:

• Sielco Sistemi Winlog Pro Multiple Security Vulnerabilities (Luigi Auriemma)
  
• Winlog Pro Homepage (Sielco Sistemi)
  
• ICS-ALERT-12-179-01�??SIELCO SISTEMI WINLOG MULTIPLE VULNERABILITIES (US-CERT)
  
• ICSA-12-213-01�??SIELCO SISTEMI WINLOG MULTIPLE VULNERABILITIES (US-CERT)