National Instruments LabVIEW 2015 < 2015 SP1 f7 / 2016 < 2016 f2 LvVarientUnflatten VI File Handling Arbitrary Code Execution
High Nessus Plugin ID 99928
An application installed on the remote Windows host is affected by an arbitrary code execution vulnerability.
The version of National Instruments (NI) LabVIEW installed on the remote Windows host is version 2015 prior to 2015 SP1 f7 or 2016 prior to 2016 f2. It is, therefore, affected by an arbitrary code execution vulnerability in the LvVarientUnflatten functionality due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted VI file, to cause a heap-based buffer overflow, allowing the execution of arbitrary code.
Upgrade to NI LabVIEW version 2015 SP1 f7 (2015.1.7) / 2016 f2 (2016.0.2) or later.