Описание
Directory traversal vulnerability in the Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x allows remote attackers to read, overwrite, or create arbitrary files via a .. (dot dot) in a request to the TCP listener service.
Directory traversal vulnerability in the Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x allows remote attackers to read, overwrite, or create arbitrary files via a .. (dot dot) in a request to the TCP listener service.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2012-6069
- https://us.codesys.com/ecosystem/security
- https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-01
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
- http://ics-cert.us-cert.gov/advisories/ICSA-14-084-01
- http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html
- http://www.digitalbond.com/tools/basecamp/3s-codesys
- http://www.securityfocus.com/bid/56300
- http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-01.pdf
Связанные уязвимости
The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This could allow the attacker to affect the availability, integrity, and confidentiality of the device.
Уязвимость среды исполнения CODESYS Runtime Toolkit, позволяющая нарушителю выполнять чтение и запись произвольных файлов
Уязвимость среды исполнения CODESYS Runtime Toolkit, позволяющая нарушителю выполнять чтение и запись произвольных файлов