Multiple Schneider Electric Products CVE-2015-0999 Local Information Disclosure Vulnerability

Bugtraq ID:	73389
Class:	Design Error
CVE:	CVE-2015-0999
Remote:	No
Local:	Yes
Published:	Mar 26 2015 12:00AM
Updated:	Mar 26 2015 12:00AM
Credit:	Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies Security Lab and Alisa Esage Shevcheckno
Vulnerable:	Schneider-Electric InTouch Machine Edition 2014 7.1.3.2 Schneider-Electric InduSoft Web Studio 7.1.3.2
Not Vulnerable:	Schneider-Electric InduSoft Web Studio 7.1.3.4 SP 3 Patch 4

Multiple Schneider Electric Products CVE-2015-0999 Local Information Disclosure Vulnerability

Multiple Schneider Electric products are prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information which may aid in further attacks.

The following products are vulnerable:

InduSoft Web Studio 7.1.3.2 and prior
InTouch Machine Edition 2014 7.1.3.2 and prior

Multiple Schneider Electric Products CVE-2015-0999 Local Information Disclosure Vulnerability

An attacker requires local interactive access to exploit the issue.

Multiple Schneider Electric Products CVE-2015-0999 Local Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Schneider Electric Products CVE-2015-0999 Local Information Disclosure Vulnerability

References:

• Schneider Electric Homepage (Schneider Electric)
  
• Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerab (Gleb Gritsai, Ilya Karpov, and Kirill Nesterov)