A vulnerability has been reported in multiple Invensys Wonderware products, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the application loading libraries in an insecure manner. This can be exploited to load an arbitrary library by tricking a user into opening certain files located on a remote WebDAV or SMB share.

The vulnerability is reported in the following products:
* InTouch versions 2012 and prior
* Wonderware Application Server versions 2012 and prior
* Wonderware Information Server versions 4.5 and prior
* Foxboro Control Software versions 4.0 and prior
* InFusion CE/FE/SCADA versions 2.5 and prior
* InBatch versions 9.5 SP1 and prior
* Wonderware Historian versions 10.0 SP1 and prior

Solution
Apply updates.
Further details available to Secunia VIM customers

Provided and/or discovered by
ICS-CERT credits Carlos Mario Penagos Hollmann.

Original Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-177-02.pdf

Deep Links
Links available to Secunia VIM customers