Inductive Automation Ignition CVE-2015-0992 Local Information Disclosure Vulnerability

Bugtraq ID:	73469
Class:	Design Error
CVE:	CVE-2015-0992
Remote:	No
Local:	Yes
Published:	Mar 31 2015 12:00AM
Updated:	Mar 31 2015 12:00AM
Credit:	Evgeny Druzhinin, Alexey Osipov, Ilya Karpov, and Gleb Gritsai of Positive Technologies
Vulnerable:	Inductive Automation Ignition 7.7.2
Not Vulnerable:

Inductive Automation Ignition CVE-2015-0992 Local Information Disclosure Vulnerability

Inductive Automation Ignition is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information such as user credentials that may aid in launching further attacks.

Inductive Automation Ignition 7.7.2 is vulnerable.

Inductive Automation Ignition CVE-2015-0992 Local Information Disclosure Vulnerability

An attacker requires local interactive access to exploit the issue.

Inductive Automation Ignition CVE-2015-0992 Local Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Inductive Automation Ignition CVE-2015-0992 Local Information Disclosure Vulnerability

References:

• Inductive Automation Ignition download page (inductive automation)
  
• Inductive Automation Ignition Vulnerabilities (ICS-CERT)