CVE-2011-1567 Memory corruption in n/a
Remote attackers can trigger stack-based buffer overflows in IGSS data server to cause denial of service or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-1567?
CVE-2011-1567 is a critical memory corruption vulnerability in n/a, published on 5 Apr 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted (1) ListAll, (2) Write File, (3) ReadFile, (4) Delete, (5) RenameFile, and (6) FileInfo commands in an 0xd opcode; (7) the Add, (8) ReadFile, (9) Write File, (10) Rename, (11) Delete, and (12) Add commands in an RMS report templates (0x7) opcode; and (13) 0x4 command in an STDREP request (0x8) opcode to TCP port 12401.
Weakness: CWE-119
Which versions are affected by CVE-2011-1567?
It affects 1 product.
Products include 7t Igss.
How do I fix CVE-2011-1567?
No fix has been published for CVE-2011-1567 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2011-1567 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-1567 exists.
Public exploit code: 2 Metasploit modules and 3 Exploit-DB entries.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xffg-hw84-w78q.