CVE-2011-0340 Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as distributed in Advantech Studio 6.1 SP6 61.6.01.05, InduSoft....
HighCVSS 9.3
EPSS 32.3%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as distributed in Advantech Studio 6.1 SP6 61.6.01.05, InduSoft Web Studio before 7.0+SP1, and InduSoft Thin Client 7.0, allow remote attackers to execute arbitrary code via a long (1) InternationalOrder, (2) InternationalSeparator, or (3) LogFileName property value; or (4) a long bstrFileName argument to the OpenScreen method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| advantech studio | = 6.1-sp6_61.6.01.05 | No fix listed |
| indusoft thin client | = 7.0 | No fix listed |
| indusoft web studio | <= 7.0 | No fix listed |
| indusoft web studio | = 6.1 | No fix listed |
| indusoft web studio | = 6.1-sp6 | No fix listed |
References
- ics-cert.us-cert.gov
- 42928 third-party-advisory vendor-advisory
- 43116 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- secunia.com vendor-advisory
- www.advantechdirect.com
- www.indusoft.com
- 47596 vdb-entry
- www.us-cert.gov
- ADV-2011-1115 vdb-entry vendor-advisory
- ADV-2011-1116 vdb-entry vendor-advisory