Code Execution Vulnerability Found in LabVIEW
Researchers at Cisco Talos have reported finding a high severity code execution vulnerability in the LabVIEW system design software from National Instruments.
According to Talos, LabVIEW 2016 version 16.0 is affected by a heap-based buffer overflow vulnerability which can be triggered with a specially crafted VI file (a LabVIEW specific format) that causes a user-controlled value to be used as a loop terminator.
By getting a targeted user to open a malicious VI file, a remote attacker can execute arbitrary code. Cisco has published an advisory containing technical details about the flaw, which is tracked as CVE-2017-2775.
The security hole was reported to National Instruments on January 13 and it was disclosed on March 22, but it’s unclear if a patch is available. An update released recently by the vendor does address a memory corruption issue that fits the description.
SecurityWeek has reached out to both Cisco and National Instruments for clarifications and will update this article if they respond.
LabVIEW is often used for data acquisition, instrument control and industrial automation, and this vulnerability could allow a threat actor to compromise a device responsible for controlling a physical system.
Source | securityweek
