Digital Electronics Pro-Server EX Vulnerabilities Advisory (ICSA-12-179-01)

Key Information: ICS Advisory: Pro-Face Pro-Server EX Vulnerabilities Last Revised: September 06, 2018 Alert Code: ICSA-12-179-01 Overview: This advisory is a follow-up to an earlier alert issued on May 16, 2012. Luigi Auriemma identified multiple vulnerabilities in the Pro-face Pro-Server EX application. Vulnerabilities include: - Invalid memory access - Integer overflow - Unhandled exception - Memory corruption Remote exploitation is possible, and public exploits targeting these vulnerabilities are known. Digital Electronics has released an update to address these vulnerabilities. Affected Products: Data management software Pro-Server EX versions 1.00.00 through 1.30.00 HMI screen editor and logic programming software GP-Pro EX and WinGP versions 2.00.00 through 3.01.100 Impact: Denial of Service (DoS) Arbitrary code execution The actual impact varies depending on the organization’s operational environment, architecture, and product implementation. Vulnerability Characterization: Memory Corruption (CWE-119): Improper restriction of operations within the bounds of a memory buffer. CVSS score: 5.8. Integer Overflow (CWE-680): Integer overflow leading to buffer overflow. CVSS score: 4.3. Unhandled Exception (CWE-388): Inadequate error handling. CVSS score: 4.3. Invalid Memory Read Access (CWE-119): Improper restriction of operations within the bounds of a memory buffer. CVSS score: 5.8. Memory Corruptions (CWE-788): Accessing memory location beyond the end of a buffer. CVSS score: 4.3. Exploitability: Remote exploitation is feasible. Public exploits are available. Moderate skill level required for exploitation. Mitigation: Digital Electronics has released a patch module. Minimize network exposure. Use secure communication methods such as VPNs. Follow recommended security practices for control systems. Vendor: Digital Electronics

Goal Reached Thanks to every supporter — we hit 100%!

Digital Electronics Pro-Server EX Vulnerabilities Advisory (ICSA-12-179-01)