Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

Bugtraq ID:	66643
Class:	Boundary Condition Error
CVE:	CVE-2014-0789
Remote:	Yes
Local:	No
Published:	Mar 25 2014 12:00AM
Updated:	Mar 25 2014 12:00AM
Credit:	Wei Gao
Vulnerable:	Schneider-Electric Opc Factory Server TLXCDSUOFS33 3.5 Schneider-Electric Opc Factory Server TLXCDSTOFS33 3.5 Schneider-Electric Opc Factory Server TLXCDLUOFS33 3.5 Schneider-Electric Opc Factory Server TLXCDLTOFS33 3.5 Schneider-Electric Opc Factory Server TLXCDLFOFS33 3.5
Not Vulnerable:	Schneider-Electric Opc Factory Server 3.5 SP1

Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

Multiple Schneider Electric Products are prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input.

Attackers can exploit this issue to cause a denial-of-service condition.

The following products are vulnerable:

TLXCDSUOFS33 3.5 and prior
TLXCDSTOFS33 3.5 and prior
TLXCDLUOFS33 3.5 and prior
TLXCDLTOFS33 3.5 and prior
TLXCDLFOFS33 3.5 and prior

Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Schneider Electric Products Stack Buffer Overflow Vulnerability

References:

• CHEMICAL FACILITY SECURITY NEWS (Patrick Coyle)
  
• Schneider Electric Homepage (Schneider Electric)
  
• Vulnerability Disclosure �?? OPC Factory Server (Schneider Electric)
  
• Schneider Electric OPC Factory Server Buffer Overflow (CERT)