CIMPLICITY Heap Overflow in 'w32rtr.exe' Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019275
|
|
SecurityTracker URL: http://securitytracker.com/id?1019275
|
|
CVE Reference: CVE-2008-0176
(Links to External Site)
|
Date: Jan 26 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 6.1 SP6 and prior service packs
|
Description: A vulnerability was reported in CIMPLICITY. A remote user can execute arbitrary code on the target system.
A remote user can send specially crafted data to port 32000 on the target system to trigger a heap overflow in the 'w32rtr.exe' process
and execute arbitrary code on the target system.
Gilad Bakas and Eyal Udassin of C4 reported this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued the following fixes:
6.1 SP6 Hot Fix - 010708_162517_6106
7.0 SIM 9
The GE advisory is available at:
http://support.gefanuc.com/support/index?page=kbchannel&id=KB12458
|
Vendor URL: support.gefanuc.com/support/index?page=kbchannel&id=KB12458 (Links to External Site)
|
Cause: Boundary error
|
Reported By: "Eyal Udassin" <eyal.udassin@c4-security.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 25 Jan 2008 12:38:27 -0500
From: "Eyal Udassin" <eyal.udassin@c4-security.com>
Subject: C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow
|
Background
-----------------
Vendor product information:
CIMPLICITY is a powerful and technically advanced HMI/SCADA product. With
its open system design approach, true client/server architecture, and the
latest web technologies, CIMPLICITY allows you to realize the benefits of
digitization for the collection, monitoring, supervisory control and sharing
of critical process and production data throughout your operations
CIMPLICITY has been used in all industries -- from process to discrete, to
system monitoring. It is extremely well suited for discrete applications,
and handles very large amounts of digital signals and alarm bursts. Its
advanced Client/Sever architecture makes it easy to start small and expand
your system.
Description
----------------
A heap overflow exists in a mandatory component in Cimplicity, which can be
triggered remotely without authentication.
The vulnerability was exploited by C4 to verify it can be used for arbitrary
code execution by an unauthorized attacker.
The description of the vulnerability is intentionally limited as this
software controls critical national infrastructure.
Impact
----------
An attacker can compromise the Cimplicity 6.1 control server, and each of
the operator workstations.
Affected Versions
-------------------------
Cimplicity HMI 6.1
Cimplicity HMI 6.1 SP5
Cimplicity HMI 6.1 SP6
Previous versions may be vulnerable, as they were not tested.
Workaround/Fix
-----------------------
The vendor issued a hotfix to resolve this vulnerability
Additional Information
-------------------------------
For additional information please contact us at info@c4-security.com. Note
that we will respond only to verified utility personnel and governmental
agencies.
The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0176
Credit
--------
This vulnerability was discovered and exploited by Gilad Bakas and Eyal
Udassin of C4.
Regards,
Eyal Udassin - C4 (Formerly Swift Coders)
33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel
eyal.udassin@c4-security.com / www.c4-security.com
<http://www.c4-security.com/>
+972-547-684989
|
|
