CVE-2011-1567

05.04.2011, 15:19

Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted (1) ListAll, (2) Write File, (3) ReadFile, (4) Delete, (5) RenameFile, and (6) FileInfo commands in an 0xd opcode; (7) the Add, (8) ReadFile, (9) Write File, (10) Rename, (11) Delete, and (12) Add commands in an RMS report templates (0x7) opcode; and (13) 0x4 command in an STDREP request (0x8) opcode to TCP port 12401.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	10 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:C/I:C/A:C
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Vendor	Product	Version
7t	igss	*

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://aluigi.org/adv/igss_2-adv.txt

http://aluigi.org/adv/igss_3-adv.txt

http://aluigi.org/adv/igss_4-adv.txt

http://aluigi.org/adv/igss_5-adv.txt

http://aluigi.org/adv/igss_7-adv.txt

http://secunia.com/advisories/43849

http://securityreason.com/securityalert/8179

http://securityreason.com/securityalert/8251

http://www.exploit-db.com/exploits/17024

http://www.securityfocus.com/bid/46936

http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-080-03.pdf

http://www.vupen.com/english/advisories/2011/0741

http://aluigi.org/adv/igss_2-adv.txt

http://aluigi.org/adv/igss_3-adv.txt

http://aluigi.org/adv/igss_4-adv.txt

http://aluigi.org/adv/igss_5-adv.txt

http://aluigi.org/adv/igss_7-adv.txt

http://secunia.com/advisories/43849

http://securityreason.com/securityalert/8179

http://securityreason.com/securityalert/8251

http://www.exploit-db.com/exploits/17024

http://www.securityfocus.com/bid/46936

http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-080-03.pdf

http://www.vupen.com/english/advisories/2011/0741