Multiple Generel Electric Products Shell Upload Vulnerability

Bugtraq ID:	65117
Class:	Input Validation Error
CVE:	CVE-2014-0751
Remote:	Yes
Local:	No
Published:	Jan 23 2014 12:00AM
Updated:	Feb 17 2014 03:56AM
Credit:	amisto0x07 and Z0mb1E of Zero Day Initiative (ZDI)
Vulnerable:
Not Vulnerable:

Multiple Generel Electric Products Shell Upload Vulnerability

Multiple General Electric (GE) products are prone to an arbitrary file-upload vulnerability.

An attacker may leverage this issue to upload arbitrary files to the affected system; this can result in an arbitrary code execution within the context of the affected application.

The following products are affected:

Proficy HMI/SCADA - CIMPLICITY 4.01 through versions 8.2
Proficy Process Systems with CIMPLICITY

Multiple Generel Electric Products Shell Upload Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Generel Electric Products Shell Upload Vulnerability

Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.

Multiple Generel Electric Products Shell Upload Vulnerability

References: