CVE-2017-12704
HighSummary
A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple vulnerabilities were identified due to a lack of proper validation of the length of user-supplied data before copying it to the heap-based buffer.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code under the context of the process, posing a serious security threat to the system.
Recommendation
It is recommended to update Advantech WebAccess to version V8.2_20170817 or later to mitigate this vulnerability.
Other vulnerabilities in Advantech WebAccess
See all- CVE-2017-12719High
An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to execute code to dereference a pointer within the program causing the application to become unavailable.
- CVE-2017-12717High
An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application.
- CVE-2017-12713High
An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts.
- CVE-2017-12711High
An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges.
- CVE-2017-12710High
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.
- CVE-2017-12702High
An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code.
- CVE-2016-0858High
A race condition in Advantech WebAccess before version 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.
- CVE-2016-0855High
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
- CVE-2016-0853High
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
- CVE-2016-0852High
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
Original NVD description (English source)
A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.