Lucene search

MitreCVE-2010-2974

HistoryAug 05, 2010 - 7:17 p.m.

CVE-2010-2974

2010-08-0519:17:55

CWE-119

mitre

web.nvd.nist.gov

cve-2010-2974

stack-based buffer overflow

iconfigurationaccess

invensys wonderware

activex control

wonderware application server

remote code execution

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

8.4

Confidence

High

EPSS

0.037

Percentile

91.9%

JSON

Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01, as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE), allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method.

Affected configurations

Nvd

Node

invensyswonderware_archestra_configuration_access_component_activex_control

AND

invensysinfusion_integrated_engineering_environment

invensyswonderware_application_serverRange≤3.1sp2

invensyswonderware_application_serverMatch2.0

invensyswonderware_application_serverMatch2.1

invensyswonderware_application_serverMatch3.0

invensyswonderware_application_serverMatch3.1

invensyswonderware_application_serverMatch3.1sp1

invensyswonderware_archestra_integrated_development_environment

VendorProductVersionCPE
invensyswonderware_archestra_configuration_access_component_activex_control*cpe:2.3:a:invensys:wonderware_archestra_configuration_access_component_activex_control:*:*:*:*:*:*:*:*
invensysinfusion_integrated_engineering_environment*cpe:2.3:a:invensys:infusion_integrated_engineering_environment:*:*:*:*:*:*:*:*
invensyswonderware_application_server*cpe:2.3:a:invensys:wonderware_application_server:*:sp2:*:*:*:*:*:*
invensyswonderware_application_server2.0cpe:2.3:a:invensys:wonderware_application_server:2.0:*:*:*:*:*:*:*
invensyswonderware_application_server2.1cpe:2.3:a:invensys:wonderware_application_server:2.1:*:*:*:*:*:*:*
invensyswonderware_application_server3.0cpe:2.3:a:invensys:wonderware_application_server:3.0:*:*:*:*:*:*:*
invensyswonderware_application_server3.1cpe:2.3:a:invensys:wonderware_application_server:3.1:*:*:*:*:*:*:*
invensyswonderware_application_server3.1cpe:2.3:a:invensys:wonderware_application_server:3.1:sp1:*:*:*:*:*:*
invensyswonderware_archestra_integrated_development_environment*cpe:2.3:a:invensys:wonderware_archestra_integrated_development_environment:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
invensys	wonderware_archestra_configuration_access_component_activex_control	*	cpe:2.3:a:invensys:wonderware_archestra_configuration_access_component_activex_control::::::::
invensys	infusion_integrated_engineering_environment	*	cpe:2.3:a:invensys:infusion_integrated_engineering_environment::::::::
invensys	wonderware_application_server	*	cpe:2.3:a:invensys:wonderware_application_server::sp2::::::*
invensys	wonderware_application_server	2.0	cpe:2.3:a:invensys:wonderware_application_server:2.0:::::::*
invensys	wonderware_application_server	2.1	cpe:2.3:a:invensys:wonderware_application_server:2.1:::::::*
invensys	wonderware_application_server	3.0	cpe:2.3:a:invensys:wonderware_application_server:3.0:::::::*
invensys	wonderware_application_server	3.1	cpe:2.3:a:invensys:wonderware_application_server:3.1:::::::*
invensys	wonderware_application_server	3.1	cpe:2.3:a:invensys:wonderware_application_server:3.1:sp1::::::
invensys	wonderware_archestra_integrated_development_environment	*	cpe:2.3:a:invensys:wonderware_archestra_integrated_development_environment::::::::

References

www.kb.cert.org/vuls/id/703189

www.kb.cert.org/vuls/id/MORO-87MHPT

www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108

wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

8.4

Confidence

High

EPSS

0.037

Percentile

91.9%

JSON

Related for CVE-2010-2974