Digital Electronics Pro-Server EX Vulnerabilities Advisory (ICSA-12-179-01)

关键信息： ICS Advisory: Pro-Face Pro-Server EX Vulnerabilities Last Revised: September 06, 2018 Alert Code: ICSA-12-179-01 Overview: The advisory is a follow-up to an earlier alert from May 16, 2012. Luigi Auriemma identified multiple vulnerabilities in the Pro-face Pro-Server EX application. Vulnerabilities: - Invalid memory access - Integer overflow - Unhandled exception - Memory corruption Remote exploitation is possible, and public exploits target these vulnerabilities. Digital Electronics has released an update addressing these vulnerabilities. Affected Products: Data management software Pro-Server EX versions 1.00.00 through 1.30.00 HMI screen editor and logic programming software GP-Pro EX and WinGP Versions 2.00.00 through 3.01.100 Impact: Denial of Service (DoS) Arbitrary code execution Impact varies based on organization's operational environment, architecture, and product implementation. Vulnerability Characterization: Memory Corruption (CWE-119): Improper restriction of operations within the bounds of a memory buffer. CVSS score 5.8. Integer Overflow (CWE-680): Integer overflow to buffer overflow. CVSS score 4.3. Unhandled Exception (CWE-388): Error handling. CVSS score 4.3. Invalid Memory Read Access (CWE-119): improper restriction of operations within the bounds of a memory buffer. CVSS score 5.8. Memory Corruptions (CWE-788): Access of memory location after end of buffer. CVSS score 4.3. Exploitability: Remote exploitation is possible. Public exploits are known. Moderate skill level required. Mitigation: Digital Electronics released a patch module. Minimize network exposure. Use secure methods like VPNs. Follow recommended practices for control systems security. Vendor: Digital Electronics

目標達成 すべての支援者に感謝 — 100%達成しました！

Digital Electronics Pro-Server EX Vulnerabilities Advisory (ICSA-12-179-01)

目標達成すべての支援者に感謝 — 100%達成しました！