Test ID:	1.3.6.1.4.1.25623.1.0.804430
Category:	Web application abuses
Title:	Advantech WebAccess Multiple Vulnerabilities
Summary:	Advantech WebAccess is prone to multiple vulnerabilities.
Description:	Summary: Advantech WebAccess is prone to multiple vulnerabilities. Vulnerability Insight: - Certain input related to some SOAP requests is not properly sanitised within the DBVisitor.dll component before being used in a SQL query. - Multiple boundary errors within the webvact.ocx ActiveX control when handling GotoCmd, NodeName2, AccessCode, UserName, and NodeName strings can be exploited to cause stack-based buffer overflows. - A boundary error within the webvact.ocx ActiveX control when handling the AccessCode2 string can be exploited to cause a stack-based buffer overflow. - Two errors within the 'OpenUrlToBuffer()' and 'OpenUrlToBufferTimeout()' methods of the BWOCXRUN.BwocxrunCtrl.1 ActiveX control can be exploited to disclose contents of arbitrary local or network resources. - An error within the 'CreateProcess()' method of the BWOCXRUN.BwocxrunCtrl.1 ActiveX control can be exploited to bypass the intended restrictions and subsequently execute arbitrary code. Vulnerability Impact: Successful exploitation will allow attackers to conduct SQL injection attacks, bypass certain security restrictions, and compromise a user's system. Affected Software/OS: Advantech WebAccess before 7.2 Solution: Upgrade to Advantech WebAccess 7.2 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0763 BugTraq ID: 66740 http://www.securityfocus.com/bid/66740 http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03 Common Vulnerability Exposure (CVE) ID: CVE-2014-0764 BugTraq ID: 66718 http://www.securityfocus.com/bid/66718 Common Vulnerability Exposure (CVE) ID: CVE-2014-0765 BugTraq ID: 66722 http://www.securityfocus.com/bid/66722 Common Vulnerability Exposure (CVE) ID: CVE-2014-0766 BugTraq ID: 66725 http://www.securityfocus.com/bid/66725 Common Vulnerability Exposure (CVE) ID: CVE-2014-0767 BugTraq ID: 66728 http://www.securityfocus.com/bid/66728 Common Vulnerability Exposure (CVE) ID: CVE-2014-0768 BugTraq ID: 66732 http://www.securityfocus.com/bid/66732 Common Vulnerability Exposure (CVE) ID: CVE-2014-0770 Common Vulnerability Exposure (CVE) ID: CVE-2014-0771 Common Vulnerability Exposure (CVE) ID: CVE-2014-0772 Common Vulnerability Exposure (CVE) ID: CVE-2014-0773
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.