CVE-2012-4357 Memory corruption in n/a
Remote attackers can execute arbitrary code on Sielco Sistemi Winlog SCADA systems by sending a malicious TCP packet with an invalid file-pointer index.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-4357?
CVE-2012-4357 is a critical memory corruption vulnerability in n/a, published on 19 Aug 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Array index error in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 might allow remote attackers to execute arbitrary code by referencing, within a port-46824 TCP packet, an invalid file-pointer index that leads to execution of an EnterCriticalSection code block.
Weakness: CWE-20
Which versions are affected by CVE-2012-4357?
It affects 2 products.
Products include Sielcosistemi Winlog Lite, Sielcosistemi Winlog Pro.
How do I fix CVE-2012-4357?
No fix has been published for CVE-2012-4357 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2012-4357 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-4357 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gmjm-f66f-wrq7.