Multiple Generel Electric Products 'gefebt.exe' Shell Upload Vulnerability
BID:65124
Info
Multiple Generel Electric Products 'gefebt.exe' Shell Upload Vulnerability
| Bugtraq ID: | 65124 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-0750 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 23 2014 12:00AM |
| Updated: | Jul 15 2015 12:14AM |
| Credit: | amisto0x07 and Z0mb1E of Zero Day Initiative (ZDI) |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Multiple Generel Electric Products 'gefebt.exe' Shell Upload Vulnerability
Multiple General Electric (GE) products are is prone to an arbitrary file-upload vulnerability.
An attacker may leverage this issue to upload arbitrary files to the affected system; this can result in arbitrary code execution within the context of the affected application.
The following products are affected:
Proficy HMI/SCADA - CIMPLICITY 4.01 through versions 8.2
Proficy Process Systems with CIMPLICITY
Multiple General Electric (GE) products are is prone to an arbitrary file-upload vulnerability.
An attacker may leverage this issue to upload arbitrary files to the affected system; this can result in arbitrary code execution within the context of the affected application.
The following products are affected:
Proficy HMI/SCADA - CIMPLICITY 4.01 through versions 8.2
Proficy Process Systems with CIMPLICITY
Exploit / POC
Multiple Generel Electric Products 'gefebt.exe' Shell Upload Vulnerability
Following exploit code is available.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Following exploit code is available.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Multiple Generel Electric Products 'gefebt.exe' Shell Upload Vulnerability
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
References
Multiple Generel Electric Products 'gefebt.exe' Shell Upload Vulnerability
References:
References: