Details of VAR-201312-0506

ID

VAR-201312-0506

TITLE

GE Proficy HMI/SCADA-iFIX 'TCPTASK.exe' Remote Buffer Overflow Vulnerability

Trust: 0.8

sources: IVD: 981b49b6-1efa-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14823

DESCRIPTION

GE Intelligent Platforms Proficy HMI/SCADA\342\200\223iFIX is the world's leading industrial automation software solution that provides process visualization, data acquisition and data monitoring for production operations. GE Proficy HMI/SCADA-iFIX 4.5, 5.0, 5.1 has a remote buffer overflow vulnerability in the implementation of the TCP/IP task process (TCPTASK.exe). Successful exploitation allows an attacker to execute arbitrary code in the context of the affected application

Trust: 0.72

sources: CNVD: CNVD-2013-14823 // IVD: 981b49b6-1efa-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 981b49b6-1efa-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14823

AFFECTED PRODUCTS

vendor:	general electric	model:	proficy hmi/scada \342\200\223 ifix	scope:	eq	version:	5.1	Trust: 0.6
vendor:	general electric	model:	proficy hmi/scada \342\200\223 ifix	scope:	eq	version:	5.0	Trust: 0.6
vendor:	general electric	model:	proficy hmi/scada \342\200\223 ifix	scope:	eq	version:	4.5	Trust: 0.6
vendor:	general electric	model:	proficy hmi/scada – ifix	scope:	eq	version:	5.1*	Trust: 0.2
vendor:	general electric	model:	proficy hmi/scada – ifix	scope:	eq	version:	5.0*	Trust: 0.2
vendor:	general electric	model:	proficy hmi/scada – ifix	scope:	eq	version:	4.5	Trust: 0.2

sources: IVD: 981b49b6-1efa-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14823

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2013-14823
value:	HIGH
Trust: 0.6
IVD:	981b49b6-1efa-11e6-abef-000c29c66e3d
value:	HIGH
Trust: 0.2

CNVD:	CNVD-2013-14823
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	981b49b6-1efa-11e6-abef-000c29c66e3d
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 981b49b6-1efa-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14823

TYPE

Buffer overflow

Trust: 0.2

sources: IVD: 981b49b6-1efa-11e6-abef-000c29c66e3d

PATCH

title:

GE Proficy HMI/SCADA-iFIX 'TCPTASK.exe' patch for remote buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchinfo/show/41401

Trust: 0.6

sources: CNVD: CNVD-2013-14823

EXTERNAL IDS

db:	CNVD	id:	CNVD-2013-14823	Trust: 0.8
db:	BID	id:	63948	Trust: 0.6
db:	IVD	id:	981B49B6-1EFA-11E6-ABEF-000C29C66E3D	Trust: 0.2

sources: IVD: 981b49b6-1efa-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14823

REFERENCES

url:

http://www.securityfocus.com/bid/63948

Trust: 0.6

sources: CNVD: CNVD-2013-14823

SOURCES

db:	IVD	id:	981b49b6-1efa-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2013-14823

LAST UPDATE DATE

2022-05-17T01:46:34.887000+00:00

SOURCES UPDATE DATE

db:

CNVD

id:

CNVD-2013-14823

date:

2013-12-03T00:00:00

SOURCES RELEASE DATE

db:	IVD	id:	981b49b6-1efa-11e6-abef-000c29c66e3d	date:	2013-12-03T00:00:00
db:	CNVD	id:	CNVD-2013-14823	date:	2013-12-03T00:00:00