CVE-2010-4557

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port 9001.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://aluigi.org/adv/inbatch_1-adv.txtExploit
http://iom.invensys.com/EN/Pages/IOM_CyberSecurityUpdates.aspxVendor Advisory
http://iom.invensys.com/EN/pdfLibrary/SecurityAlert_Invensys_SecurityAlert-LFSEC00000051_12-10.pdfVendor Advisory
http://secunia.com/advisories/42528Vendor Advisory
http://www.exploit-db.com/exploits/15707
http://www.kb.cert.org/vuls/id/647928US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-10-348-01.pdfUS Government Resource
http://www.vupen.com/english/advisories/2010/3244Vendor Advisory
http://aluigi.org/adv/inbatch_1-adv.txtExploit
http://iom.invensys.com/EN/Pages/IOM_CyberSecurityUpdates.aspxVendor Advisory
http://iom.invensys.com/EN/pdfLibrary/SecurityAlert_Invensys_SecurityAlert-LFSEC00000051_12-10.pdfVendor Advisory
http://secunia.com/advisories/42528Vendor Advisory
http://www.exploit-db.com/exploits/15707
http://www.kb.cert.org/vuls/id/647928US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-10-348-01.pdfUS Government Resource
http://www.vupen.com/english/advisories/2010/3244Vendor Advisory

Timeline

Published: Dec 17, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-45587.5phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Troj CVE-2010-45624.3Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when using IPv6, allows remote attackers to determine whether a host is sniffing the n CVE-2010-45635.0The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Req CVE-2010-45652.1The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kerne CVE-2010-45669.3The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NT CVE-2010-45674.3Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1)CVE-2010-45687.5Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does n CVE-2010-45694.3Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script CVE-2010-45704.3Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote CVE-2010-45724.3CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows CVE-2010-45739.3The Update Installer in VMware ESXi 4.1, when a modified sfcb.cfg is present, does not properly configure the SFCB authentication mode, whic CVE-2010-45747.5The Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 on 64-bit Linux platforms