CVE:CVE-2012-0258
CNNVD:CNNVD-201203-597
多个Invensys产品中存在多个基于堆的缓冲区溢出漏洞。攻击者可利用这些漏洞在使用该ActiveX控件的应用程序上下文中执行任意代码（典型如IE），攻击失败可能导致拒绝服务。以下产品中存在这些漏洞：Wonderware Application Server 2012及之前版本，Foxboro Control Software 3.1及之前版本，InFusion CE/FE/SCADA 2.5及之前版本，Wonderware Information Server 4.5及之前版本，ArchestrA Application Object Toolkit 3.2及之前版本和InTouch 10.0版本至10.5版本。
solution:Upgrade invensys archestra_application_object_toolkit to a higher version than 3.2,and avoid the version (,3.2]; Upgrade invensys foxboro_control_software to a higher version than 3.1,and avoid the version (,3.1]; Upgrade invensys infusion_control_edition to a higher version than 2.5,and avoid the version (,2.5]; Upgrade invensys infusion_foundation_edition to a higher version than 2.5,and avoid the version (,2.5]; Upgrade invensys infusion_scada to a higher version than 2.5,and avoid the version (,2.5]; Upgrade invensys intouch to a higher version than 10.0,10.5,and avoid the version 10.0,10.5; Upgrade invensys wonderware_application_server to a higher version than 2012,and avoid the version (,2012]; Upgrade invensys wonderware_information_server to a higher version than 4.5,3.1,4.0,4.0:sp1,and avoid the version (,4.5],3.1,4.0,4.0:sp1