Stack-based buffer overflow in BizViz and GENESIS32 - CVE-2011-2089

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a long string in the argument. NOTE: some of these details are obtained from third party information. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2011-2089

Links to Public Exploits and PoC-codes

• Exploit #4365 - ICONICS WebHMI - ActiveX Buffer Overflow (Metasploit) (August 11, 2020)
• Exploit #4367 - ICONICS WebHMI - ActiveX Stack Overflow (August 11, 2020)

External References

• http://secunia.com/advisories/44417
• http://www.exploit-db.com/exploits/17240
• http://www.exploit-db.com/exploits/17269
• http://www.osvdb.org/72135
• http://www.security-assessment.com/files/documents/advisory/ICONICS_WebHMI.pdf
• http://www.securityfocus.com/bid/47704
• http://www.us-cert.gov/control_systems/pdf/ICSA-11-131-01.pdf
• http://www.vupen.com/english/advisories/2011/1174
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67267