GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY CimWebServer.exe目录遍历漏洞

2014-02-10T00:00:00
ID SSV:61399
Type seebug
Reporter Root
Modified 2014-02-10T00:00:00

Description

CVE(CAN) ID: CVE-2014-0751

GE Proficy CIMPLICITY是客户端/服务器业务可视化和控制解决方案。

GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 8.2 SIM 24之前版本中,CimWebServer.exe(即组件WebView)及Proficy Process Systems在实现上存在目录遍历漏洞,远程攻击者通过向TCP端口10212发送特制的消息,利用此漏洞可执行任意代码。 0 ge-ip Proficy CIMPLICITY < 8.2 SIM 24 厂商补丁:

ge-ip

目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

http://www.ge-ip.com/products/proficy-hmi-scada-cimplicity/p2819

GE产品安全公告: http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 GEIP13-06 Proficy HMI/SCADA - CIMPLICITY 8.2 SIM 24下载位置: http://support.ge-ip.com/support/index?page=dwchannel&id=DN4128

http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940