CVE:CVE-2012-2516
CNNVD:CNNVD-201206-523
GE Proficy是一个为用户提供用于自动化控制和嵌入式领域的软硬件产品、服务以及专业技术。
多个GE Proficy产品中存在远程基于栈的缓冲区溢出漏洞和命令注入漏洞。攻击者可利用这些漏洞在使用ActiveX控件的受影响应用程序（典型的IE浏览器）上下文中执行任意shell命令和代码，攻击失败将导致拒绝服务。
solution:Upgrade ge intelligent_platforms_proficy_batch_execution to a higher version than 5.6,and avoid the version 5.6; Upgrade ge intelligent_platforms_proficy_historian to a higher version than 3.1,3.5,4.0,4.5,and avoid the version 3.1,3.5,4.0,4.5; Upgrade ge intelligent_platforms_proficy_hmi/scada_ifix to a higher version than 5.0,5.1,and avoid the version 5.0,5.1; Upgrade ge intelligent_platforms_proficy_pulse to a higher version than 1.0,and avoid the version 1.0; Upgrade ge intelligent_platforms_si7_i/o_driver to a higher version than 7.20,7.42,and avoid the version 7.20,7.42