icsa-20-315-01
Vulnerability from csaf_cisa
Published
2020-11-10 00:00
Modified
2020-11-10 00:00
Summary
ICSA-20-315-01_OSIsoft PI Interface for OPC XML-DA
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
OSIsoft reported this vulnerability to CISA.
Exploitability
No known public exploits specifically target this vulnerability.
{ "document": { "acknowledgments": [ { "organization": "OSIsoft", "summary": "reporting this vulnerability to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "summary", "text": "OSIsoft reported this vulnerability to CISA.", "title": "Summary" }, { "category": "other", "text": "No known public exploits specifically target this vulnerability.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "CISAservicedesk@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-20-315-01 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-315-01.json" }, { "category": "self", "summary": "ICS Advisory ICSA-20-315-01 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-315-01" } ], "title": "ICSA-20-315-01_OSIsoft PI Interface for OPC XML-DA", "tracking": { "current_release_date": "2020-11-10T00:00:00.000000Z", "generator": { "engine": { "name": "CISA USCert CSAF Generator", "version": "1" } }, "id": "ICSA-20-315-01", "initial_release_date": "2020-11-10T00:00:00.000000Z", "revision_history": [ { "date": "2020-11-10T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-20-315-01 OSIsoft PI Interface for OPC XML-DA" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c 1.7.3.x", "product": { "name": "PI Interface for OPC XML-DA: All versions prior to 1.7.3.x are affected", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "PI Interface for OPC XML-DA" } ], "category": "vendor", "name": "OSIsoft LLC" } ] }, "vulnerabilities": [ { "cve": "CVE-2013-0006", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.CVE-2013-0006 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Upgrade to PI Interface for OPC XML-DA Version 1.7.3.x to remove this vulnerability.", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "Security bulletin and access to security update is available on the OSIsoft customer portal (login required).", "product_ids": [ "CSAFPID-0001" ], "url": "https://customers.osisoft.com/s/knowledgearticle?knowledgeArticleUrl=000031534" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2013-0006" } ] }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.