SB2017070703 - Multiple vulnerabilities in Schneider Electric Wonderware ArchestrA Logger
Published: July 7, 2017
Security Bulletin ID
SB2017070703
CSH Severity
High
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2017-9629)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to stack-based buffer overflow. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of the vulnerability may result in system compromise.
2) Resource exhaustion (CVE-ID: CVE-2017-9627)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause DoS condition.
The weakness exists due to uncontrolled resource consumption. A remote attacker can use specially crafted input to exhaust the memory resources and cause the system to crash.
Successful exploitation of the vulnerability results in denial of service.
3) Null pointer dereference (CVE-ID: CVE-2017-9631)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to cause DoS condition.
The weakness exists due to NULL pointer dereference. A remote attacker can cause the service for logging and log-viewing to crash.
Successful exploitation of the vulnerability results in denial of service.
Remediation
Install update from vendor's website.