SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-748905942] Unitronics VisiLogic OPLC IDE vlp File Parsing Stack Buffer Overflow Vulnerability

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2016-06-23HMI, PLCUnitronics VisilogicSteven SeeleyN/A2016-4519N/AN/AN/A

Source

						
							
								
#
# Unitronics VisiLogic OPLC IDE vlp File Parsing Stack Buffer Overflow Vulnerability
#


### OVERVIEW

ZDI has identified a buffer overflow vulnerability discovered by Steven Seeley of Source Incite in Unitronics VisiLogic. Unitronics has produced a new version to mitigate this vulnerability.

This vulnerability could be exploited remotely.




### AFFECTED PRODUCTS

Unitronics reports that the vulnerability affects the following versions of VisiLogic:
Visilogic prior to Version 9.8.30






### IMPACT

By exploiting this vulnerability, an attacker may be able to remotely execute arbitrary code.

Impact to individual organizations depends on many factors that are unique to each organization. NCCIC/ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.






### BACKGROUND

Unitronics has offices in the United States and Israel.

The affected product, Unitronics VisiLogic OPLC IDE, is an HMI and PLC application programming environment for Vision and SAMBA series controllers. According to Unitronics, this product is used worldwide in multiple sectors.





### VULNERABILITY CHARACTERIZATION


# VULNERABILITY OVERVIEW

STACK-BASED BUFFER OVERFLOW

The failure is caused by an attempt to copy into a fixed-length stack buffer without validating its length.
CVE-2016-4519 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).





### VULNERABILITY DETAILS


# EXPLOITABILITY

This vulnerability could be exploited remotely.


# EXISTENCE OF EXPLOIT

No known public exploits specifically target this vulnerability.


# DIFFICULTY

An attacker with a low skill would be able to exploit this vulnerability.





### MITIGATION

Unitronics recommends that users upgrade to Visilogic Version 9.8.30 or later to mitigate this vulnerability. 

The latest version can be found on the Unitronics web site at the following location:
http://unitronicsplc.com/software-visilogic/