Multiple WellinTech Products ActiveX Remote Code Execution Vulnerability
BID:64941
Info
Multiple WellinTech Products ActiveX Remote Code Execution Vulnerability
| Bugtraq ID: | 64941 |
| Class: | Design Error |
| CVE: |
CVE-2013-2827 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 14 2014 12:00AM |
| Updated: | Aug 01 2014 01:11AM |
| Credit: | Andrea Micalizzi via Zero Day Initiative |
| Vulnerable: |
Wellintech KingSCADA 3.0 |
| Not Vulnerable: | |
Discussion
Multiple WellinTech Products ActiveX Remote Code Execution Vulnerability
Multiple WellinTech products are prone to a remote code-execution vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts will likely result in denial-of-service conditions.
Multiple WellinTech products are prone to a remote code-execution vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts will likely result in denial-of-service conditions.
Exploit / POC
Multiple WellinTech Products ActiveX Remote Code Execution Vulnerability
The following exploit is available:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit is available:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Multiple WellinTech Products ActiveX Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple WellinTech Products ActiveX Remote Code Execution Vulnerability
References:
References: