Description
Multiple stack-based buffer overflows in Schneider Electric VAMPSET 2.2.136 and earlier allow local users to cause a denial of service (application halt) via a malformed (1) setting file or (2) disturbance recording file.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Schneider Electric VAMPSET
Default version status: unaffected
0 to ≤ 2.2.136affected2.2.145unaffected
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-254-01 ↗
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-254-01.json ↗
- http://www.schneider-electric.com/products/ww/en/2300-ied-user-software/2320-vamp-user-software/62050-vamp-software/ ↗
- https://ics-cert.us-cert.gov/advisories/ICSA-14-254-01 ↗