Main Vulnerability Database Vulnerabilities #VU12590

Buffer overflow in FactoryTalk Activation Manager - CVE-2015-8277

Published: May 10, 2018 / Updated: April 7, 2020

Vulnerability identifier: #VU12590

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-8277

CWE-ID:

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.

The weakness exists in the custom string copying function of the license server manager due to improper bounds checking on incoming data. A remote attacker can send specially crafted packet with opcode (a) 0x107 or (b) 0x10a, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

FactoryTalk Activation Manager
Wonderware License Server

How to mitigate CVE-2015-8277

Update to version 4.02.

FactoryTalk Activation Manager - update to 4.02

Links to Public Exploits and PoC-codes

Exploit #2324 - CVE-2015-8277-Exploit () (April 7, 2020)

External References

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073133