SB2017070703 - Multiple vulnerabilities in Schneider Electric Wonderware ArchestrA Logger
Published: July 7, 2017
Security Bulletin ID
SB2017070703
Severity
High
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2017-9629)
The vulnerability allows a remote attacker to execute arbitrary code.The weakness exists due to stack-based buffer overflow. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of the vulnerability may result in system compromise.
2) Resource exhaustion (CVE-ID: CVE-2017-9627)
The vulnerability allows a remote attacker to cause DoS condition.The weakness exists due to uncontrolled resource consumption. A remote attacker can use specially crafted input to exhaust the memory resources and cause the system to crash.
Successful exploitation of the vulnerability results in denial of service.
3) Null pointer dereference (CVE-ID: CVE-2017-9631)
The vulnerability allows a remote attacker to cause DoS condition.The weakness exists due to NULL pointer dereference. A remote attacker can cause the service for logging and log-viewing to crash.
Successful exploitation of the vulnerability results in denial of service.
Remediation
Install update from vendor's website.