CVE:CVE-2012-3005
CNNVD:CNNVD-201207-432
Invensys Wonderware多个产品中存在漏洞，可被恶意攻击者利用操控用户的系统。该漏洞源于应用程序在不安全方式中加载库。攻击者可利用该漏洞通过诱使用户打开位于远程WebDAV或SMB分享的项目文件加载任意库。以下产品中存在漏洞：InTouch 2012版本和早期版本、Wonderware Application Server 2012版本和早期版本、Wonderware Information Server 4.5版本和早期版本、Foxboro Control Software 4.0版本和早期版本、InFusion CE/FE/SCADA 2.5版本和早期版本、InBatch 9.5 SP1版本和早期版本、Wonderware Historian 10.0 SP1版本和早期版本。
solution:Upgrade invensys foxboro_control_software to a higher version than 3.1,4.0,and avoid the version 3.1,4.0; Upgrade invensys infusion_ce/fe/scada to a higher version than 2.5,and avoid the version (,2.5]; Upgrade invensys intouch to a higher version than 2012,and avoid the version (,2012]; Upgrade invensys intouch/wonderware_application_server to a higher version than 2012,10.0,10.5,and avoid the version (,2012],10.0,10.5; Upgrade invensys wonderware_historian to a higher version than *:sp1,10.0,and avoid the version *:sp1,10.0; Upgrade invensys wonderware_inbatch to a higher version than *:sp1,and avoid the version *:sp1; Upgrade invensys wonderware_information_server to a higher version than 4.5,3.1,4.0,4.0:sp1,and avoid the version (,4.5],3.1,4.0,4.0:sp1