CVE-2011-4870

{"id": "CVE-2011-4870", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-01-08T00:55:02.130", "references": [{"url": "http://www.securityfocus.com/bid/51129", "source": "cret@cert.org"}, {"url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-332-01A.pdf", "tags": ["US Government Resource"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0 and 9.0 SP1, and InBatch 8.1 SP1, 9.0 SP2, and 9.5 Server and Runtime Clients, allow remote attackers to execute arbitrary code via a long string in a property value, a different issue than CVE-2011-3141."}, {"lang": "es", "value": "M\u00faltiples desbordamientos de b\u00fafer en los controles ActiveX (1) GUIControls, (2) BatchObjSrv, y (3) BatchSecCtrl en Invensys Wonderware InBatch v9.0 y v9.0 SP1 asi como en InBatch v8.1 SP1, v9.0 SP2 y v9.5 Server. Tambien en los clientes en tiempo de ejecuci\u00f3n. Estos desbordamientos de b\u00fafer permiten a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una cadena demasiado larga en el valor de una propiedad. Se trata de un problema diferente a CVE-2011-3141."}], "lastModified": "2012-01-09T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:invensys:wonderware_inbatch:8.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5EEF22E-A52F-48AE-A898-FA9857583404"}, {"criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E99C8469-4F7B-42AD-BEF0-2EAA85926552"}, {"criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "010329D7-904D-40EC-97A3-2874DD3C199D"}, {"criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80F5BF86-0AFA-4072-9835-32A86F233D4B"}, {"criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E11F7AF3-D707-4BAE-9F14-7FAD87FC92A1"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}