CVE-2011-1918
GE Proficy Historian ihDataArchiver.exe Trusted Header Size Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 SIM 12 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic.
Desbordamiento de buffer de pila en el servicio "Data Archiver" de GE Intelligent Platforms Proficy Historian en versiones anteriores a la 3.5 SIM 17 y 4.x anteriores a 4.0 SIM 12. Permite a atacantes remotos provocar una denegación de servicio (caída del demonio) o posiblemente ejecutar código arbitrario a través de tráfico TCP modificado.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy Historian. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ihDataArchiver.exe process which listens by default on TCP port 14000. The code within this module trusts a value supplied over the network and uses it as a length when copying user-supplied data to a stack buffer. By providing a large enough value, this buffer can be overflowed leading to arbitrary code execution under the context of the user running the service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-05-09 CVE Reserved
- 2011-11-02 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://ics-cert.us-cert.gov/advisories/ICSA-11-243-03A | X_refsource_misc | |
| http://www.securityfocus.com/bid/50475 | Vdb Entry | |
| http://www.us-cert.gov/control_systems/pdf/ICSA-11-243-03.pdf | Us Government Resource |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ge Search vendor "Ge" | Intelligent Platforms Proficy Historian Search vendor "Ge" for product "Intelligent Platforms Proficy Historian" | <= 3.5 Search vendor "Ge" for product "Intelligent Platforms Proficy Historian" and version " <= 3.5" | - |
Affected
| ||||||
| Ge Search vendor "Ge" | Intelligent Platforms Proficy Historian Search vendor "Ge" for product "Intelligent Platforms Proficy Historian" | 4.0 Search vendor "Ge" for product "Intelligent Platforms Proficy Historian" and version "4.0" | - |
Affected
| ||||||