Inductive Automation Ignition CVE-2015-0995 Security Bypass Vulnerability

Bugtraq ID:	73475
Class:	Access Validation Error
CVE:	CVE-2015-0995
Remote:	Yes
Local:	No
Published:	Mar 31 2015 12:00AM
Updated:	Mar 31 2015 12:00AM
Credit:	Evgeny Druzhinin, Alexey Osipov, Ilya Karpov, and Gleb Gritsai of Positive Technologies.
Vulnerable:	Inductive Automation Ignition 7.7.2
Not Vulnerable:

Inductive Automation Ignition CVE-2015-0995 Security Bypass Vulnerability

Inductive Automation Ignition is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and aid in brute-force attacks; other attacks may also be possible.

Inductive Automation Ignition 7.7.2 is vulnerable; other versions may also be affected.

Inductive Automation Ignition CVE-2015-0995 Security Bypass Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Inductive Automation Ignition CVE-2015-0995 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Inductive Automation Ignition CVE-2015-0995 Security Bypass Vulnerability

References:

• Inductive Automation Ignition download page (inductive automation)
  
• Inductive Automation Ignition Vulnerabilities (ICS-CERT)