Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

Bugtraq ID:	66500
Class:	Boundary Condition Error
CVE:	CVE-2013-0662
Remote:	Yes
Local:	No
Published:	Mar 27 2014 12:00AM
Updated:	Mar 19 2015 09:42AM
Credit:	This issue is reported by vendor.
Vulnerable:	Schneider Electric Unity Pro 6.0 Schneider Electric Unity Pro 6 Schneider Electric OPC Factory Server 3.34 Schneider Electric OPC Factory Driver 3.34
Not Vulnerable:

Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

Multiple Schneider Electric Products are prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.

The following products are vulnerable:

TwidoSuite 2.31.04 and prior
PowerSuite 2.6 and prior
SoMove 1.7 and prior
SoMachine 2.0, 3.0, 3.1, and 3.0 XS
Unity Pro 7.0 and prior
UnityLoader 2.3 and prior
Concept 2.6 SR7 and prior
ModbusCommDTM sl 2.1.2 and prior
PL7 4.5 SP5 and prior
SFT2841 14, 13.1 and prior
OPC Factory Server 3.50 and prior

Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

References:

• Schneider Electric Homepage (Schneider Electric)