CVE-2011-4052

Related Files

Zero Day Initiative Advisory 11-329

Posted Nov 17, 2011

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 11-329 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Indusoft WebStudio. Authentication is not required to exploit this vulnerability. The flaw exists within the CEServer component which is used as a runtime dependency for applications deployed using Indusoft WebStudio. When handling the Remove File operation (0x15) the process blindly copies user supplied data to a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.

tags | advisory, remote, arbitrary

advisories | CVE-2011-4052

SHA-256 | 7d1a3ab5327ab886bcdf60133ec7548633c2606fe9cb4da9e31ef77badf69036

Download | Favorite | View