{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:16:20.093Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
          },
          {
            "name": "80891",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/80891"
          },
          {
            "name": "48675",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48675"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member, leading to a function-pointer overwrite."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-11-20T10:00:00",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
        },
        {
          "name": "80891",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/80891"
        },
        {
          "name": "48675",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48675"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2012-0257",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member, leading to a function-pointer overwrite."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf",
              "refsource": "MISC",
              "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
            },
            {
              "name": "80891",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/80891"
            },
            {
              "name": "48675",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48675"
            },
            {
              "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf",
              "refsource": "MISC",
              "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2012-0257",
    "datePublished": "2012-04-02T20:00:00",
    "dateReserved": "2011-12-21T00:00:00",
    "dateUpdated": "2024-08-06T18:16:20.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T02:55:45.509Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VU#703189",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/703189"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/MORO-87MHPT"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01, as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE), allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-08-05T19:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "VU#703189",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/703189"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kb.cert.org/vuls/id/MORO-87MHPT"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-2974",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01, as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE), allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#703189",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/703189"
            },
            {
              "name": "http://www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108",
              "refsource": "CONFIRM",
              "url": "http://www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108"
            },
            {
              "name": "https://wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm",
              "refsource": "CONFIRM",
              "url": "https://wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm"
            },
            {
              "name": "http://www.kb.cert.org/vuls/id/MORO-87MHPT",
              "refsource": "CONFIRM",
              "url": "http://www.kb.cert.org/vuls/id/MORO-87MHPT"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-2974",
    "datePublished": "2010-08-05T19:00:00Z",
    "dateReserved": "2010-08-05T00:00:00Z",
    "dateUpdated": "2024-09-17T03:43:16.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:16:20.081Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
          },
          {
            "name": "80891",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/80891"
          },
          {
            "name": "48675",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48675"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the AddFile member."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-11-20T10:00:00",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
        },
        {
          "name": "80891",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/80891"
        },
        {
          "name": "48675",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48675"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2012-0258",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the AddFile member."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf",
              "refsource": "MISC",
              "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
            },
            {
              "name": "80891",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/80891"
            },
            {
              "name": "48675",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48675"
            },
            {
              "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf",
              "refsource": "MISC",
              "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2012-0258",
    "datePublished": "2012-04-02T20:00:00",
    "dateReserved": "2011-12-21T00:00:00",
    "dateUpdated": "2024-08-06T18:16:20.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:21:03.634Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "49173",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49173"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-06-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-08-13T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "49173",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49173"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-3847",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "49173",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49173"
            },
            {
              "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf",
              "refsource": "MISC",
              "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-3847",
    "datePublished": "2012-07-05T01:00:00",
    "dateReserved": "2012-07-04T00:00:00",
    "dateUpdated": "2024-08-06T20:21:03.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:50:05.451Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "49173",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49173"
          },
          {
            "name": "53563",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/53563"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-06-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System Platform software suite, as used in InTouch/Wonderware Application Server IT before 10.5 and WAS before 3.5, DASABCIP before 4.1 SP2, DASSiDirect before 3.0, DAServer Runtime Components before 3.0 SP2, and other products, allows remote attackers to cause a denial of service (daemon crash or hang) via a long Unicode string."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-08-13T09:00:00",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "49173",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49173"
        },
        {
          "name": "53563",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/53563"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2012-3007",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System Platform software suite, as used in InTouch/Wonderware Application Server IT before 10.5 and WAS before 3.5, DASABCIP before 4.1 SP2, DASSiDirect before 3.0, DAServer Runtime Components before 3.0 SP2, and other products, allows remote attackers to cause a denial of service (daemon crash or hang) via a long Unicode string."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "49173",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49173"
            },
            {
              "name": "53563",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/53563"
            },
            {
              "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf",
              "refsource": "MISC",
              "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2012-3007",
    "datePublished": "2012-07-05T01:00:00",
    "dateReserved": "2012-05-30T00:00:00",
    "dateUpdated": "2024-08-06T19:50:05.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invensys:intouch:2012:*:*:*:*:*:*:*",
              "matchCriteriaId": "F87CFACA-2891-47A6-8AB7-4C27C0DDD415",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:2012:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FF76A0A-F7BF-4AF4-87A9-465427566800",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007."
    },
    {
      "lang": "es",
      "value": "slssvc.exe en Invensys Wonderware SuiteLink en Invensys InTouch 2012 y Wonderware Application Server 2012, permite a atacantes remotos causar una denegaci\u00f3n de servicio (consumo de recursos) a trav\u00e9s de una larga cadena Unicode, una vulnerabilidad diferente a CVE-2012-3007."
    }
  ],
  "id": "CVE-2012-3847",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-07-05T03:23:18.683",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/49173"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/49173"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_archestra_configuration_access_component_activex_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B08B61E8-62EF-46B0-8881-300A02E911F5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invensys:infusion_integrated_engineering_environment:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9294B6B1-7D7C-461B-ADC1-D90251FADB96",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:*:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "C53D322C-1D42-479E-9225-40684655F4CA",
              "versionEndIncluding": "3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "68FA27FB-6AA3-4E6F-83EB-066DAF0BD3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B64216A-3D05-4384-8B35-845974B99128",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5EA5956-AFFF-4AF6-8E51-60B702E4E3FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA9909E3-C0C3-4EE8-A592-948D8F90E569",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.1:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "2576F8F1-DA43-47E1-95D9-9A9233FCD2B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_archestra_integrated_development_environment:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C0CE9E0-61A4-4D92-BB3F-4437E77E27CE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01, as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE), allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en pila en la interfaz IConfigurationAccess en el control ActiveX Invensys Wonderware Archestra ConfigurationAccessComponent de Wonderware Application Server (WAS) anterior a v3.1 SP2 P01, como el usado en el Wonderware Archestra Integrated Development Environment (IDE) y el InFusion Integrated Engineering Environment (IEE), permite a los atacantes remotos ejecutar c\u00f3digo a su elecci\u00f3n a trav\u00e9s del primer argumento del m\u00e9todo UnsubscribeData."
    }
  ],
  "evaluatorSolution": "Per: http://www.kb.cert.org/vuls/id/703189\r\n\r\n\u0027According to Invensys, users that are using IAS 2.1 (all versions)-IDE, WAS 3.0 (all versions)-IDE, WAS 3.1 (all versions)-IDE, InFusion CE 2.0-IEE, InFusion FE 1.0 (all versions)-IEE, InFusion FE 2.0-IEE, InFusion SCADA 2.0\u2013IEE should apply the vendor security update. This vulnerability is not present in Wonderware Application Server 3.1 Service Pack 2 Patch 01 (WAS 3.1 SP2 P01).\u0027",
  "id": "CVE-2010-2974",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-08-05T19:17:55.543",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/703189"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.kb.cert.org/vuls/id/MORO-87MHPT"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/703189"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.kb.cert.org/vuls/id/MORO-87MHPT"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsID=203108"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://wdnresource.wonderware.com/support/kbcd/html/1/t002492.htm"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invensys:archestra_application_object_toolkit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCC6A67B-2844-4839-8CA2-C612C5B1EACB",
              "versionEndIncluding": "3.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:foxboro_control_software:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7F29DDE-04A2-462F-BA35-C1B27B9E96DF",
              "versionEndIncluding": "3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:infusion_control_edition:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FBBD076-515A-470F-9C29-A902C2042A24",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:infusion_foundation_edition:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D10B2C8-CC92-491E-91F6-EAD96E878BE3",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:infusion_scada:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAACC06C-4E8C-4E66-B007-E6BC9DAFEEAF",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:intouch:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BDF7AED-4176-4EB8-8557-582BA29B63D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:intouch:10.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF608404-2B0D-4FD1-9768-E984AE5F23D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "550932A9-9B6A-439A-A5A4-CAFB24DB28C8",
              "versionEndIncluding": "2012",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4265378-CF22-42AC-B63C-73F96507E680",
              "versionEndIncluding": "4.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "262CBEB8-A6EA-48DE-B5A5-460660F33442",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC154F44-2618-4AD5-B252-98E521F98CEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "325DE4D6-7649-4566-BC6E-1F8DC16FF1A9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member, leading to a function-pointer overwrite."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en memoria din\u00e1mica  en el componente ActiveX WWCabFile en Wonderware System Platform en Invensys Wonderware Application Server 2012 y anteriores, Foxboro Control Software v3.1 y anteriores, InFusion CE/FE/SCADA v2.5 y anteriores, Wonderware Information Server v4.5 y anteriores, ArchestrA Application Object Toolkit v3.2 y anteriores, y InTouch v10.0 hasta v10.5 ,permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de una cadena larga sobre el miembro Open, provocando una sobrescritura de un puntero a funci\u00f3n."
    }
  ],
  "id": "CVE-2012-0257",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-04-02T20:55:02.187",
  "references": [
    {
      "source": "cret@cert.org",
      "url": "http://osvdb.org/80891"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/48675"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
    },
    {
      "source": "cret@cert.org",
      "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/80891"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/48675"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invensys:dasabcip:*:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "3441E270-D814-45F3-86C1-C67F418C9B83",
              "versionEndIncluding": "4.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:dasabcip:4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E84BEFDA-22B6-4F5E-A7EF-C4B9DA44C6B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:daserver_runtime_components:*:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "8AC1ED0F-D74C-4595-8DF4-C9F30895CE15",
              "versionEndIncluding": "3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:daserver_runtime_components:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FE73143-BDF4-41C3-9D00-C4138FDDA179",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:dassidirect:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18941771-CFCA-4F18-8F2B-7C90F5673AA2",
              "versionEndIncluding": "2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:intouch\\/wonderware_application_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C28F1AE-E010-4F53-914D-2BCC9FD512C1",
              "versionEndIncluding": "10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:*:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "C53D322C-1D42-479E-9225-40684655F4CA",
              "versionEndIncluding": "3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5EA5956-AFFF-4AF6-8E51-60B702E4E3FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.0.200:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "FF2F376E-2D08-4C72-B8DE-DF090A93B637",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA9909E3-C0C3-4EE8-A592-948D8F90E569",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.1:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "2576F8F1-DA43-47E1-95D9-9A9233FCD2B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:3.1.201:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "40204711-D1E2-4C9A-976B-55DE6FA83A43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System Platform software suite, as used in InTouch/Wonderware Application Server IT before 10.5 and WAS before 3.5, DASABCIP before 4.1 SP2, DASSiDirect before 3.0, DAServer Runtime Components before 3.0 SP2, and other products, allows remote attackers to cause a denial of service (daemon crash or hang) via a long Unicode string."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de buffer basado en pila en slssvc.exe antes de v58.x en Invensys Wonderware SuiteLink en el Invensys System Platform software suite, como se usa en InTouch/Wonderware Application Server IT antes de v10.5 y WAS before v3.5, DASABCIP antes de v4.1 SP2, DASSiDirect antes de v3.0, DAServer Runtime Components antes de v3.0 SP2, y otros productos, permite a atacantes remotos causar una denegaci\u00f3n de servicio (ca\u00edda del demonio o bloqueo) a trav\u00e9s de una larga cadena Unicode."
    }
  ],
  "id": "CVE-2012-3007",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-07-05T03:23:18.637",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "url": "http://secunia.com/advisories/49173"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "url": "http://www.securityfocus.com/bid/53563"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/49173"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/53563"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-171-01.pdf"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invensys:archestra_application_object_toolkit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCC6A67B-2844-4839-8CA2-C612C5B1EACB",
              "versionEndIncluding": "3.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:foxboro_control_software:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7F29DDE-04A2-462F-BA35-C1B27B9E96DF",
              "versionEndIncluding": "3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:infusion_control_edition:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FBBD076-515A-470F-9C29-A902C2042A24",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:infusion_foundation_edition:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D10B2C8-CC92-491E-91F6-EAD96E878BE3",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:infusion_scada:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAACC06C-4E8C-4E66-B007-E6BC9DAFEEAF",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:intouch:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BDF7AED-4176-4EB8-8557-582BA29B63D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:intouch:10.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF608404-2B0D-4FD1-9768-E984AE5F23D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_application_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "550932A9-9B6A-439A-A5A4-CAFB24DB28C8",
              "versionEndIncluding": "2012",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4265378-CF22-42AC-B63C-73F96507E680",
              "versionEndIncluding": "4.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "262CBEB8-A6EA-48DE-B5A5-460660F33442",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC154F44-2618-4AD5-B252-98E521F98CEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "325DE4D6-7649-4566-BC6E-1F8DC16FF1A9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the AddFile member."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en memoria din\u00e1mica  en el componente ActiveX WWCabFile en Wonderware System Platform en Invensys Wonderware Application Server 2012 y anteriores, Foxboro Control Software v3.1 y anteriores, InFusion CE/FE/SCADA v2.5 y anteriores, Wonderware Information Server v4.5 y anteriores, ArchestrA Application Object Toolkit v3.2 y anteriores, y InTouch v10.0 hasta v10.5 ,permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de una cadena larga sobre el miembro Addfile."
    }
  ],
  "id": "CVE-2012-0258",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-04-02T20:55:02.230",
  "references": [
    {
      "source": "cret@cert.org",
      "url": "http://osvdb.org/80891"
    },
    {
      "source": "cret@cert.org",
      "url": "http://secunia.com/advisories/48675"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
    },
    {
      "source": "cret@cert.org",
      "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/80891"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/48675"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}