« Volver al listado

CVE-2011-4870

Estado: ModificadaMedia (6.8)—

Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0 and 9.0 SP1, and InBatch 8.1 SP1, 9.0 SP2, and 9.5 Server and Runtime Clients, allow remote attackers to execute arbitrary code via a long string in a property value, a different issue than CVE-2011-3141.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Invensys — Wonderware Inbatch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-4870",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-01-08T00:55:02.130",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/51129",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-332-01A.pdf",
      "tags": [
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/51129",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-11-332-01A.pdf",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0 and 9.0 SP1, and InBatch 8.1 SP1, 9.0 SP2, and 9.5 Server and Runtime Clients, allow remote attackers to execute arbitrary code via a long string in a property value, a different issue than CVE-2011-3141."
    },
    {
      "lang": "es",
      "value": "Múltiples desbordamientos de búfer en los controles ActiveX (1) GUIControls, (2) BatchObjSrv, y (3) BatchSecCtrl en Invensys Wonderware InBatch v9.0 y v9.0 SP1 asi como en InBatch v8.1 SP1, v9.0 SP2 y v9.5 Server. Tambien en los clientes en tiempo de ejecución. Estos desbordamientos de búfer permiten a atacantes remotos ejecutar código de su elección a través de una cadena demasiado larga en el valor de una propiedad. Se trata de un problema diferente a CVE-2011-3141."
    }
  ],
  "lastModified": "2026-06-16T23:35:32.913",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_inbatch:8.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5EEF22E-A52F-48AE-A898-FA9857583404"
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E99C8469-4F7B-42AD-BEF0-2EAA85926552"
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "010329D7-904D-40EC-97A3-2874DD3C199D"
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80F5BF86-0AFA-4072-9835-32A86F233D4B"
            },
            {
              "criteria": "cpe:2.3:a:invensys:wonderware_inbatch:9.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E11F7AF3-D707-4BAE-9F14-7FAD87FC92A1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}