(уязвимость) Schneider Electric Wonderware System Platform Vulnerabilities

---

Данный пост перенесён автоматически с предыдущего варианта сайта. Возможны артефакты. Если информация этого поста важна для вас, свяжитесь со мной для получения полного содержимого.

---

OVERVIEW

Ivan Sanchez of WiseSecurity Team has identified a fixed search path vulnerability in Schneider Electric’s Wonderware InTouch, Application Server, Historian, and SuiteLink applications, which are part of the Wonderware System Platform suite. Schneider Electric has produced a patch that mitigates this vulnerability. Ivan Sanchez has tested the patch to validate that it resolves the vulnerability.

AFFECTED PRODUCTS

The following Schneider Electric products are affected:

• Wonderware System Platform 2014 R2 and prior versions.

IMPACT

Successful exploitation of this vulnerability would require the victim to install and execute malicious code that could result in arbitrary code execution.

Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.

BACKGROUND

Schneider Electric’s corporate headquarters is located in Paris, France, and maintains offices in more than 100 countries worldwide.

According to Schneider Electric, the Wonderware System Platform, is deployed across several sectors including Chemical, Commercial Facilities, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater Systems. Schneider Electric estimates that these products are used worldwide.

Источник: ICS-CERT Advisory (ICSA-15-169-02)

--- === @zlonov === ---

---

--- === @zlonov === ---