SB2020061914 - Multiple vulnerabilities in ICONICS GENESIS64 and GENESIS32

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020061914

SB2020061914 - Multiple vulnerabilities in ICONICS GENESIS64 and GENESIS32

Published: June 19, 2020 Updated: July 1, 2020

Security Bulletin ID SB2020061914
Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 60% Medium 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2020-12011)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in VariantClear in GenBroker64/GenBroker32 component. A remote attacker can send a specially crafted communication packet, trigger out-of-bounds write and execute arbitrary code on the target system.


2) Deserialization of Untrusted Data (CVE-ID: CVE-2020-12015)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure input validation when processing serialized data in IcoFwxServer GenBroker64/GenBroker32 component. A remote attacker can use a specially crafted communication packet and cause a denial of service condition on the target system.


3) Deserialization of Untrusted Data (CVE-ID: CVE-2020-12009)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insecure input validation when processing serialized data in GenBroker64/GenBroker32 component in Workbench Pack-and-Go function. A remote attacker can use a specially crafted PKGX files to execute arbitrary code.



4) SQL injection (CVE-ID: CVE-2020-12013)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the TestQuery endpoint of the IcoFwxServer service. A remote attacker can use a specially crafted WCF client that interfaces to the FrameWorX Server and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


5) Deserialization of Untrusted Data (CVE-ID: CVE-2020-12007)

The vulnerability allows a remote attacker to perform a DoS attack.

The vulnerability exists due to insecure input validation when processing serialized data in fwxserver   component. A remote attacker can send a specially crafted communication packet to the FrameWorX Server and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References