Schneider Electric OPC Factory Server Buffer Overflow (Schneider Electric OPC Factory Server (OFS))
En bref
- Source
- NVD
- EPSS
- EPSS 2.47 % · centile 85 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- icscert
- Statut NVD
- Modified
Description
Multiple buffer overflows in the OPC Automation 2.0 Server Object ActiveX control in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 3.5 and earlier, TLXCDSTOFS33 3.5 and earlier, TLXCDLUOFS33 3.5 and earlier, TLXCDLTOFS33 3.5 and earlier, and TLXCDLFOFS33 3.5 and earlier allow remote attackers to cause a denial of service via long arguments to unspecified functions.
Faiblesses (CWE)
- CWE-122 — Débordement de tampon sur le tas
- CWE-119 — Opération hors des limites d'un tampon mémoire
Références
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-093-01
- http://www.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2014/03/20140325_vulnerability_disclosure_opc_factory_server.xml
- http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page
- http://ics-cert.us-cert.gov/advisories/ICSA-14-093-01
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | icscert |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · ics-cert@hq.dhs.gov (Secondary) |
| CVSS 2.0 | HIGH 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2014-0820
- GCVE · GCVE-0-2014-0789
Configurations affectées (CPE NVD)
cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdlfofs:*:*:*:*:*:*:*:*≤ 3.35cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdltofs:*:*:*:*:*:*:*:*≤ 3.35cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdluofs:*:*:*:*:*:*:*:*≤ 3.35cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdstofs:*:*:*:*:*:*:*:*≤ 3.35cpe:2.3:h:schneider-electric:opc_factory_server_tlxcdsuofs:*:*:*:*:*:*:*:*≤ 3.35
Produits affectés
| Produit | Versions |
|---|---|
| Schneider Electric · OPC Factory Server (OFS) | affected 0 ≤ TLXCDSUOFS33 – V3.5 ; affected 0 ≤ TLXCDSTOFS33 – V3.5 ; affected 0 ≤ TLXCDLUOFS33 – V3.5 ; affected 0 ≤ TLXCDLTOFS33 – V3.5 ; affected 0 ≤ TLXCDLFOFS33 – V3.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |