CVE-2011-3143 Use after free in n/a

What is CVE-2011-3143?

CVE-2011-3143 is a critical use after free vulnerability in n/a, published on 16 Aug 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified long strings that trigger heap memory corruption.

Weakness: CWE-399

Which versions are affected by CVE-2011-3143?

It affects 3 products.

Products include Aveva Clearscada, Schneider-Electric Scx 67, Schneider-Electric Scx 68.

How do I fix CVE-2011-3143?

No fix has been published for CVE-2011-3143 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2011-3143 being exploited?

There is no known exploitation of CVE-2011-3143 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-6021 Denial of service in ClearSCADA High 7.5
• CVE-2017-9962 Memory corruption in ClearSCADA High 7.5
• CVE-2014-0779 Memory corruption in ClearSCADA Medium 6.8
• CVE-2014-5412 Schneider Electric SCADA Expert ClearSCADA Improper Authentication Medium 6.4
• CVE-2014-5413 Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vvc6-fgrx-mqr8.