WellinTech KingView 6.53 < 2011-11-20 HistoryServer.exe nettransdll.dll Module Op-code 3 Packet Parsing Remote Overflow
critical Nessus Plugin ID 59376
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 5.9
Synopsis
The remote Windows host contains an application that is affected by a remote buffer overflow vulnerability.Description
According to its version, the instance of WellinTech KingView installed on the remote Windows host is affected by a remote buffer overflow vulnerability. A flaw exists inside of 'nettransdll.dll' that may permit unauthenticated, remote attackers to execute arbitrary code in the context of the application. 'HistorySrv.exe' listens on port 777. When a specially-crafted request is received requesting service opcode 0x03, a buffer is allocated based on a size field in the request. Once the buffer has been created, data from the packet is copied into the buffer based on yet another size field. By making the buffer size field smaller than the data size field, a heap overflow can be accomplished.Solution
Install the patch referenced in the vendor's advisory.See Also
https://www.zerodayinitiative.com/advisories/ZDI-11-351/
http://web.archive.org/web/20120312094902/http://en.wellintech.com:80/news/detail.aspx?contentid=166
Plugin Details
Severity: Critical
ID: 59376
File Name: scada_kingview_6_53_2011-11-20.nbin
Version: 1.141
Type: local
Agent: windows
Family: SCADA
Published: 6/5/2012
Updated: 4/14/2021
Dependencies: scada_app_wellintech_kingview_detect.nbin
Risk Information
Risk Factor: Critical
VPR Score: 5.9
CVSS Score Source: CVE-2011-4536
CVSS v2.0
Base Score: 10
Temporal Score: 7.4
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:wellintech:kingview
Required KB Items: SCADA/Apps/WellinTech/KingView/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 11/20/2011
Vulnerability Publication Date: 12/20/2011
Reference Information
CVE: CVE-2011-4536
BID: 51159
ICSA: 11-355-02