Sign-up

ID

VAR-201101-0361


CVE

CVE-2011-0517


TITLE

Winlog Pro Malformed message stack buffer overflow vulnerability

Trust: 1.0

sources: IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1 // IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-0194

DESCRIPTION

Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted 0x02 opcode to TCP port 46823. Sielco Sistemi Winlog of TCP/IP The server contains a buffer overflow vulnerability. Sielco Sistemi Winlog In “Run TCP/IP server” There is a function of 46823/tcp using. A stack buffer overflow vulnerability exists in processing crafted packets. Attack code using this vulnerability has been released.Service disruption by a remote third party (DoS) An attacker may be able to attack or execute arbitrary code. Winlog Pro is an application for data acquisition and remote control of SCADA HMI monitoring software. The SCADA software can be run as a TCP/IP server by listening to the TCP 46823 port by enabling the \"Run TCP/IP server\" option in the project section \"Configuration->Options->TCP/IP\". The 0x02 opcode of the protocol is used to process some strings received by the client, and a function such as _TCPIP_WriteNumValueFP, _TCPIP_WriteDigValueFP or _TCPIP_WriteStrValueFP is called according to the data type. They parse the data using the same function at offset 00446795, and there is a stack overflow when copying the input data to the temporary buffer: 00446795 /$ 55 PUSH EBP 00446796 |. 8BEC MOV EBP, ESP 00446798 |. 83C4 C0 ADD ESP, -40 0044679B |. 53 PUSH EBX 0044679C |. 56 PUSH ESI 0044679D |. 57 PUSH EDI 0044679E |. 8B45 0C MOV EAX, DWORD PTR SS:[EBP+C] 004467A1 |. 8B5D 08 MOV EBX,DWORD PTR SS:[ EBP+8] 004467A4 |. 8BF8 MOV EDI,EAX 004467A6 |. 33C0 XOR EAX,EAX 004467A8 |. 56 PUSH ESI 004467A9 |. 83C9 FF OR ECX,FFFFFFFF 004467AC |. F2:AE REPNE SCAS BYTE PTR ES:[EDI] ; stren 004467AE |. F7D1 NOT ECX 004467B0 |. 2BF9 SUB EDI,ECX 004467B2 |. 8D75 C0 LEA ESI,DWORD PTR SS:[EBP-40] 004467B5 |. 87F7 XCHG EDI,ESI 004467B7 |. 8BD1 MOV EDX,ECX 004467B9 |. 8BC7 MOV EAX, EDI 00446 7BB |. C1E9 02 SHR ECX,2 004467BE |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] ; memcpy. Winlog Pro is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input. Failed attacks will cause denial-of-service conditions. Winlog Pro 2.07.00 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). Request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: Winlog Pro TCP/IP Server Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA42894 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/42894/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=42894 RELEASE DATE: 2011-01-15 DISCUSS ADVISORY: http://secunia.com/advisories/42894/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/42894/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=42894 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Luigi Auriemma has reported a vulnerability in Winlog Pro, which can be exploited by malicious people to compromise a vulnerable system. Successful exploitation may allow execution of arbitrary code, but requires the "Run TCP/IP Server" option to be enabled (disabled by default). SOLUTION: Update to version 2.07.01. PROVIDED AND/OR DISCOVERED BY: Luigi Auriemma ORIGINAL ADVISORY: http://aluigi.altervista.org/adv/winlog_1-adv.txt OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.6

sources: NVD: CVE-2011-0517 // CERT/CC: VU#496040 // JVNDB: JVNDB-2011-001154 // CNVD: CNVD-2011-0194 // BID: 45813 // IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1 // IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d // PACKETSTORM: 97557

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.0

sources: IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1 // IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d // CNVD: CNVD-2011-0194

AFFECTED PRODUCTS

vendor:sielcosistemimodel:winlog proscope:lteversion:2.07.00

Trust: 1.0

vendor:sielcomodel:sistemi winlog proscope:eqversion:2.7

Trust: 0.9

vendor:sielcomodel: - scope: - version: -

Trust: 0.8

vendor:sielco sistemimodel:winlog litescope:ltversion:2.07.01 earlier

Trust: 0.8

vendor:sielco sistemimodel:winlog proscope:ltversion:2.07.01 earlier

Trust: 0.8

vendor:sielcosistemimodel:winlog proscope:eqversion:2.07.00

Trust: 0.6

vendor:winlog promodel: - scope:eqversion:*

Trust: 0.4

vendor:sielcomodel:sistemi winlog proscope:neversion:2.7.1

Trust: 0.3

sources: IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1 // IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d // CERT/CC: VU#496040 // CNVD: CNVD-2011-0194 // BID: 45813 // JVNDB: JVNDB-2011-001154 // CNNVD: CNNVD-201101-322 // NVD: CVE-2011-0517

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-0517
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#496040
value: 1.10

Trust: 0.8

NVD: CVE-2011-0517
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201101-322
value: CRITICAL

Trust: 0.6

IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1
value: CRITICAL

Trust: 0.2

IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d
value: CRITICAL

Trust: 0.2

nvd@nist.gov: CVE-2011-0517
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1 // IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d // CERT/CC: VU#496040 // JVNDB: JVNDB-2011-001154 // CNNVD: CNNVD-201101-322 // NVD: CVE-2011-0517

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2011-001154 // NVD: CVE-2011-0517

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201101-322

TYPE

Buffer overflow

Trust: 1.0

sources: IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1 // IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201101-322

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-001154

PATCH
title:Top Pageurl:http://www.sielcosistemi.com/en/products/winlog_scada_hmi/index.html
Trust: 0.8
title:Winlog Pro malformed message stack buffer overflow vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/2609
Trust: 0.6
title:WinlogLite_Setupurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=37217
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2011-0194 // 
            
            
            
            JVNDB: JVNDB-2011-001154 // 
            
            
            
            CNNVD: CNNVD-201101-322

EXTERNAL IDS
db:BIDid:45813
Trust: 3.3
db:NVDid:CVE-2011-0517
Trust: 3.1
db:ICS CERTid:ICSA-11-017-02
Trust: 2.6
db:CERT/CCid:VU#496040
Trust: 2.6
db:SECUNIAid:42894
Trust: 2.5
db:EXPLOIT-DBid:15992
Trust: 2.4
db:VUPENid:ADV-2011-0126
Trust: 2.4
db:OSVDBid:70418
Trust: 2.4
db:XFid:64716
Trust: 1.4
db:CNVDid:CNVD-2011-0194
Trust: 1.0
db:CNNVDid:CNNVD-201101-322
Trust: 1.0
db:SREASONid:8280
Trust: 1.0
db:JVNDBid:JVNDB-2011-001154
Trust: 0.8
db:NSFOCUSid:17104
Trust: 0.6
db:IVDid:7D7E8B81-463F-11E9-9A21-000C29342CB1
Trust: 0.2
db:IVDid:1836B484-1FA3-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:97557
Trust: 0.1
sources:
            
            
            IVD: 7d7e8b81-463f-11e9-9a21-000c29342cb1 // 
            
            
            
            IVD: 1836b484-1fa3-11e6-abef-000c29c66e3d // 
            
            
            
            CERT/CC: VU#496040 // 
            
            
            
            CNVD: CNVD-2011-0194 // 
            
            
            
            BID: 45813 // 
            
            
            
            JVNDB: JVNDB-2011-001154 // 
            
            
            
            PACKETSTORM: 97557 // 
            
            
            
            CNNVD: CNNVD-201101-322 // 
            
            
            
            NVD: CVE-2011-0517

REFERENCES
url:http://www.us-cert.gov/control_systems/pdf/icsa-11-017-02.pdf
Trust: 2.6
url:http://osvdb.org/70418
Trust: 2.4
url:http://secunia.com/advisories/42894
Trust: 2.4
url:http://www.securityfocus.com/bid/45813
Trust: 2.4
url:http://www.vupen.com/english/advisories/2011/0126
Trust: 2.4
url:http://www.kb.cert.org/vuls/id/496040
Trust: 1.8
url:http://www.exploit-db.com/exploits/15992
Trust: 1.6
url:http://aluigi.org/adv/winlog_1-adv.txt
Trust: 1.6
url:http://xforce.iss.net/xforce/xfdb/64716
Trust: 1.4
url:http://aluigi.altervista.org/adv/winlog_1-adv.txt
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/64716
Trust: 1.0
url:http://securityreason.com/securityalert/8280
Trust: 1.0
url:http://www.exploit-db.com/exploits/15992/
Trust: 0.8
url:http://www.sielcosistemi.com/download/winloglite_setup.exe
Trust: 0.8
url:http://www.sielcosistemi.com/download/winlog_setup_sf.exe
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0517
Trust: 0.8
url:http://jvn.jp/cert/jvnvu496040
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0517
Trust: 0.8
url:http://www.nsfocus.net/vulndb/17104
Trust: 0.6
url:http://www.sielcosistemi.com/en/products/winlog_scada_hmi/
Trust: 0.3
url:http://secunia.com/advisories/42894/
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://secunia.com/advisories/42894/#comments
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/products/corporate/vim/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=42894
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#496040 // 
            
            
            
            CNVD: CNVD-2011-0194 // 
            
            
            
            BID: 45813 // 
            
            
            
            JVNDB: JVNDB-2011-001154 // 
            
            
            
            PACKETSTORM: 97557 // 
            
            
            
            CNNVD: CNNVD-201101-322 // 
            
            
            
            NVD: CVE-2011-0517

CREDITS
Luigi Auriemma
Trust: 0.9
sources:
            
            
            BID: 45813 // 
            
            
            
            CNNVD: CNNVD-201101-322

SOURCES
db:IVDid:7d7e8b81-463f-11e9-9a21-000c29342cb1
db:IVDid:1836b484-1fa3-11e6-abef-000c29c66e3d
db:CERT/CCid:VU#496040
db:CNVDid:CNVD-2011-0194
db:BIDid:45813
db:JVNDBid:JVNDB-2011-001154
db:PACKETSTORMid:97557
db:CNNVDid:CNNVD-201101-322
db:NVDid:CVE-2011-0517

LAST UPDATE DATE
2025-04-11T23:04:23.474000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#496040date:2011-02-03T00:00:00
db:CNVDid:CNVD-2011-0194date:2011-01-17T00:00:00
db:BIDid:45813date:2015-03-19T09:45:00
db:JVNDBid:JVNDB-2011-001154date:2011-03-03T00:00:00
db:CNNVDid:CNNVD-201101-322date:2011-01-21T00:00:00
db:NVDid:CVE-2011-0517date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:7d7e8b81-463f-11e9-9a21-000c29342cb1date:2011-01-17T00:00:00
db:IVDid:1836b484-1fa3-11e6-abef-000c29c66e3ddate:2011-01-17T00:00:00
db:CERT/CCid:VU#496040date:2011-02-03T00:00:00
db:CNVDid:CNVD-2011-0194date:2011-01-17T00:00:00
db:BIDid:45813date:2011-01-14T00:00:00
db:JVNDBid:JVNDB-2011-001154date:2011-03-03T00:00:00
db:PACKETSTORMid:97557date:2011-01-14T03:38:37
db:CNNVDid:CNNVD-201101-322date:2011-01-21T00:00:00
db:NVDid:CVE-2011-0517date:2011-01-20T19:00:12.287