Description Preview
This CVE refers to multiple buffer overflow vulnerabilities in the F1BookView ActiveX control (F1 Bookview) used by Schneider Electric ProClima prior to version 6.2. These flaws enable remote attackers to execute arbitrary code by exploiting the affected ActiveX methods, including Attach, DefinedName, DefinedNameLocal, ODBCPrepareEx, ObjCreatePolygon, SetTabbedTextEx, or SetValidationRule. This is described as a separate vulnerability from CVE-2015-8561.
Overview
The F1BookView ActiveX control in Schneider Electric ProClima versions prior to 6.2 contains several buffer overflow flaws that can be triggered by remote attackers, potentially allowing them to run arbitrary code on a vulnerable machine. The issue is associated with multiple methods within the control, making it possible to exploit through crafted inputs and reach a full system compromise if the control is exposed to untrusted contexts. The advisories indicate this is a distinct vulnerability from CVE-2015-8561 and provide multiple references for mitigation and remediation.
Remediation
- Upgrade to Schneider Electric ProClima version 6.2 or newer, and apply all available updates.
- Apply the official patch referenced as SEVD-2015-329-01 from Schneider Electric.
- If upgrading is not feasible, implement mitigations:
- Restrict or disable the F1BookView ActiveX control in environments where it is not required.
- Block or sandbox the ActiveX control in web browsers and network endpoints that process untrusted inputs.
- Limit network and host exposure of systems running vulnerable ProClima components; apply network segmentation and least-privilege controls.
- Monitor for vendor advisories and apply patches promptly when available.
References
- ZDI-15-631: http://www.zerodayinitiative.com/advisories/ZDI-15-631
- ZDI-15-625: http://www.zerodayinitiative.com/advisories/ZDI-15-625
- ICS-CERT Advisory ICSA-15-335-02: https://ics-cert.us-cert.gov/advisories/ICSA-15-335-02
- ZDI-15-634: http://www.zerodayinitiative.com/advisories/ZDI-15-634
- ZDI-15-632: http://www.zerodayinitiative.com/advisories/ZDI-15-632
- ZDI-15-630: http://www.zerodayinitiative.com/advisories/ZDI-15-630
- ZDI-15-633: http://www.zerodayinitiative.com/advisories/ZDI-15-633
- ZDI-15-635: http://www.zerodayinitiative.com/advisories/ZDI-15-635
- Schneider Electric SEVD-2015-329-01: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-329-01
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services: Low
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services: Low
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting: Low
- Arts, Entertainment & RecreationArts, Entertainment & Recreation: Low
- ConstructionConstruction: Low
- Educational ServicesEducational Services: Low
- Finance and InsuranceFinance and Insurance: Low
- Health Care & Social AssistanceHealth Care & Social Assistance: Low
- InformationInformation: Low
- Management of Companies & EnterprisesManagement of Companies & Enterprises: Low
- ManufacturingManufacturing: Low
- MiningMining: Low
- Other Services (except Public Administration)Other Services (except Public Administration): Low
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services: Low
- Public AdministrationPublic Administration: Low
- Real Estate Rental & LeasingReal Estate Rental & Leasing: Low
- Retail TradeRetail Trade: Low
- Transportation & WarehousingTransportation & Warehousing: Low
- UtilitiesUtilities: Low
- Wholesale TradeWholesale Trade: Low
