Summary
An update is available that resolves vulnerability in the product versions listed as affected in this advisory.
An attacker who successfully exploited this vulnerability could insert and run arbitrary code in the system.
Vulnerabilities 1
-
Medium 5.5
Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib
SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Revision history
-
#3
Removed typo in document.title
-
#2
Initial CISA Republication of ABB PSIRT 2NGA002813 advisory
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF version
https://search.abb.com/library/Download.aspx?DocumentID=2NGA002813&LanguageCode=en&DocumentPartId=&Action=Launch
-
1MRS758440, Rev. H PCM600 Cyber Security Deployment Guideline
https://search.abb.com/library/Download.aspx?DocumentID=1MRS758440&LanguageCode=en&DocumentPartId=ABB&Action=Launch
-
ICS Advisory ICSA-26-120-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-120-02
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b