9.3

CVE-2012-4359

Exploit
Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 do not validate the return value of the realloc function, which allows remote attackers to cause a denial of service (invalid 0x00 write operation and daemon crash) or possibly have unspecified other impact via a port-46824 TCP packet with a crafted negative integer after the opcode.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4358.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sielcosistemi ≫ Winlog Pro Version <= 2.07.17
Sielcosistemi ≫ Winlog Pro Version2.06.00
Sielcosistemi ≫ Winlog Pro Version2.06.03
Sielcosistemi ≫ Winlog Pro Version2.06.04
Sielcosistemi ≫ Winlog Pro Version2.06.06
Sielcosistemi ≫ Winlog Pro Version2.06.09
Sielcosistemi ≫ Winlog Pro Version2.06.10
Sielcosistemi ≫ Winlog Pro Version2.06.12
Sielcosistemi ≫ Winlog Pro Version2.06.13
Sielcosistemi ≫ Winlog Pro Version2.06.14
Sielcosistemi ≫ Winlog Pro Version2.06.18
Sielcosistemi ≫ Winlog Pro Version2.06.21
Sielcosistemi ≫ Winlog Pro Version2.06.24
Sielcosistemi ≫ Winlog Pro Version2.06.25
Sielcosistemi ≫ Winlog Pro Version2.06.28
Sielcosistemi ≫ Winlog Pro Version2.06.40
Sielcosistemi ≫ Winlog Pro Version2.06.46
Sielcosistemi ≫ Winlog Pro Version2.06.50
Sielcosistemi ≫ Winlog Pro Version2.06.60
Sielcosistemi ≫ Winlog Pro Version2.06.73
Sielcosistemi ≫ Winlog Pro Version2.06.86
Sielcosistemi ≫ Winlog Pro Version2.07.00
Sielcosistemi ≫ Winlog Pro Version2.07.01
Sielcosistemi ≫ Winlog Pro Version2.07.08
Sielcosistemi ≫ Winlog Pro Version2.07.09
Sielcosistemi ≫ Winlog Pro Version2.07.11
Sielcosistemi ≫ Winlog Pro Version2.07.14
Sielcosistemi ≫ Winlog Pro Version2.07.16
Sielcosistemi ≫ Winlog Lite Version <= 2.07.17
Sielcosistemi ≫ Winlog Lite Version2.06.00
Sielcosistemi ≫ Winlog Lite Version2.06.03
Sielcosistemi ≫ Winlog Lite Version2.06.04
Sielcosistemi ≫ Winlog Lite Version2.06.06
Sielcosistemi ≫ Winlog Lite Version2.06.09
Sielcosistemi ≫ Winlog Lite Version2.06.10
Sielcosistemi ≫ Winlog Lite Version2.06.12
Sielcosistemi ≫ Winlog Lite Version2.06.13
Sielcosistemi ≫ Winlog Lite Version2.06.14
Sielcosistemi ≫ Winlog Lite Version2.06.18
Sielcosistemi ≫ Winlog Lite Version2.06.21
Sielcosistemi ≫ Winlog Lite Version2.06.24
Sielcosistemi ≫ Winlog Lite Version2.06.25
Sielcosistemi ≫ Winlog Lite Version2.06.28
Sielcosistemi ≫ Winlog Lite Version2.06.40
Sielcosistemi ≫ Winlog Lite Version2.06.46
Sielcosistemi ≫ Winlog Lite Version2.06.50
Sielcosistemi ≫ Winlog Lite Version2.06.60
Sielcosistemi ≫ Winlog Lite Version2.06.73
Sielcosistemi ≫ Winlog Lite Version2.06.86
Sielcosistemi ≫ Winlog Lite Version2.07.00
Sielcosistemi ≫ Winlog Lite Version2.07.01
Sielcosistemi ≫ Winlog Lite Version2.07.08
Sielcosistemi ≫ Winlog Lite Version2.07.09
Sielcosistemi ≫ Winlog Lite Version2.07.11
Sielcosistemi ≫ Winlog Lite Version2.07.14
Sielcosistemi ≫ Winlog Lite Version2.07.16
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.52% 0.828
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/49395
Vendor Advisory
http://www.sielcosistemi.com/en/news/index.html?id=70
http://www.us-cert.gov/control_systems/pdf/ICSA-12-213-01.pdf
US Government Resource
http://aluigi.org/adv/winlog_2-adv.txt
Exploit