CVE-2012-0257: Buffer Overflow
First published: Mon Apr 02 2012(Updated: )
Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member, leading to a function-pointer overwrite.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Invensys Archestra Application Object Toolkit | <=3.2 | |
| Invensys Foxboro Control Software | <=3.1 | |
| Invensys Infusion Control Edition | <=2.5 | |
| Invensys Infusion Foundation Edition | <=2.5 | |
| Invensys Infusion Scada | <=2.5 | |
| AVEVA InTouch 2014 | =10.0 | |
| AVEVA InTouch 2014 | =10.5 | |
| Invensys Wonderware Application Server | <=2012 | |
| Invensys Wonderware Information Server | <=4.5 | |
| Invensys Wonderware Information Server | =3.1 | |
| Invensys Wonderware Information Server | =4.0 | |
| Invensys Wonderware Information Server | =4.0-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-0257?
CVE-2012-0257 is rated as high severity due to the risk of remote code execution through a heap-based buffer overflow.
How do I fix CVE-2012-0257?
To fix CVE-2012-0257, update to the latest version of the affected software as recommended by the vendor.
Which software is affected by CVE-2012-0257?
CVE-2012-0257 affects various Invensys software, including Wonderware Application Server 2012 and earlier, amongst others.
What are the potential impacts of CVE-2012-0257?
The potential impacts of CVE-2012-0257 include unauthorized access and execution of arbitrary code on affected systems.
Is there a workaround for CVE-2012-0257?
There are no known effective workarounds for CVE-2012-0257; upgrading the software is recommended for mitigation.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/invensys
- canonical/invensys archestra application object toolkit
- version/invensys archestra application object toolkit/3.2
- canonical/invensys foxboro control software
- version/invensys foxboro control software/3.1
- canonical/invensys infusion control edition
- version/invensys infusion control edition/2.5
- canonical/invensys infusion foundation edition
- version/invensys infusion foundation edition/2.5
- canonical/invensys infusion scada
- version/invensys infusion scada/2.5
- canonical/aveva intouch 2014
- version/aveva intouch 2014/10.0
- version/aveva intouch 2014/10.5
- canonical/invensys wonderware application server
- version/invensys wonderware application server/2012
- canonical/invensys wonderware information server
- version/invensys wonderware information server/4.5
- version/invensys wonderware information server/3.1
- version/invensys wonderware information server/4.0
- version/invensys wonderware information server/4.0-sp1