IniNet Solutions SCADA Web Server < 2.02.0000
Critical Nessus Network Monitor Plugin ID 9011
SynopsisThe remote host is running a version of IniNet Solutions SCADA Web Server that has multiple vulnerabilities.
DescriptionThe remote host is running the IniNet Solutions SCADA Web Server that is subject to the following vulnerabilities :
- An overflow condition exists in an unspecified function. The issue is triggered as user-supplied input is not properly validated when handling multiple fields in HTTP requests. This may allow a remote attacker to cause a stack-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2015-1001)
- A flaw exists that is triggered when handling input that has been URL encoded. This may allow an unauthorized attacker to make changes to arbitrary files. (CVE-2015-1002)
- A flaw exists that allows traversing outside of a restricted path. The issue is due to the progam not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can gain access to arbitrary files. (CVE-2015-1003)
SolutionUpgrade to version 2.02.0000 or later.