Ecava IntegraXor < 4.2.4488 Privilege Escalation

medium Nessus Plugin ID 82698

Language:

Synopsis

A SCADA application installed on the remote Windows host is affected by a privilege escalation vulnerability.

Description

The version of Ecava IntegraXor SCADA Server installed on the remote Windows host is prior to version 4.2.4488. It is, therefore, affected by a privilege escalation vulnerability due to using an insecure path when loading DLL files. A local attacker with administrative access to the default installation location can exploit this flaw to plant a malicious DLL file containing code that can then be run with the privileges of the application.

Solution

Upgrade to version 4.2.4488 or later.

Plugin Details

Severity: Medium

ID: 82698

File Name: scada_app_ecava_integraxor_4_2_4488.nbin

Version: 1.94

Type: local

Family: SCADA

Published: 4/10/2015

Updated: 4/15/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.3

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:ecava:integraxor

Required KB Items: installed_sw/Ecava IntegraXor

Exploit Ease: No known exploits are available

Patch Publication Date: 4/1/2015

Vulnerability Publication Date: 3/31/2015

Reference Information

CVE: CVE-2015-0990

BID: 73472

ICSA: 15-090-02

Detections

Analytics