Schneider Electric Ampla MES ICSA-17-187-05 Multiple Local Security Vulnerabilities

Bugtraq ID:	99469
Class:	Design Error
CVE:	CVE-2017-9637 CVE-2017-9635
Remote:	No
Local:	Yes
Published:	Jul 06 2017 12:00AM
Updated:	Jul 06 2017 12:00AM
Credit:	Ilya Karpov
Vulnerable:	Schneider-Electric Ampla Manufacturing Execution System (MES) 6.4 Schneider-Electric Ampla Manufacturing Execution System (MES) 6.0
Not Vulnerable:	Schneider-Electric Ampla Manufacturing Execution System (MES) 6.5

Schneider Electric Ampla MES ICSA-17-187-05 Multiple Local Security Vulnerabilities

Schneider Electric Ampla MES is prone to a local information-disclosure vulnerability and a security-weakness.

Local attackers can exploit these issues to obtain sensitive information which may aid in further attacks.

Ampla MES 6.4 and prior are vulnerable.

Schneider Electric Ampla MES ICSA-17-187-05 Multiple Local Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Schneider Electric Ampla MES ICSA-17-187-05 Multiple Local Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Schneider Electric Ampla MES ICSA-17-187-05 Multiple Local Security Vulnerabilities

References:

• Schneider Electric Homepage (Schneider Electric)
  
• ICSA-17-187-05 CVE-2017-9637 CVE-2017-9635 Schneider Electric Ampla MES (CERT)