SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   CIMPLICITY Vendors:   General Electric Company
CIMPLICITY Heap Overflow in 'w32rtr.exe' Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1019275
SecurityTracker URL:  http://securitytracker.com/id/1019275
CVE Reference:   CVE-2008-0176   (Links to External Site)
Date:  Jan 26 2008
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.1 SP6 and prior service packs
Description:   A vulnerability was reported in CIMPLICITY. A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted data to port 32000 on the target system to trigger a heap overflow in the 'w32rtr.exe' process and execute arbitrary code on the target system.

Gilad Bakas and Eyal Udassin of C4 reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   The vendor has issued the following fixes:

6.1 SP6 Hot Fix - 010708_162517_6106
7.0 SIM 9

The GE advisory is available at:

http://support.gefanuc.com/support/index?page=kbchannel&id=KB12458

Vendor URL:  support.gefanuc.com/support/index?page=kbchannel&id=KB12458 (Links to External Site)
Cause:   Boundary error

Message History:   None.


 Source Message Contents

Subject:  C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow

Background
-----------------
Vendor product information:
CIMPLICITY is a powerful and technically advanced HMI/SCADA product. With
its open system design approach, true client/server architecture, and the
latest web technologies, CIMPLICITY allows you to realize the benefits of
digitization for the collection, monitoring, supervisory control and sharing
of critical process and production data throughout your operations
CIMPLICITY has been used in all industries -- from process to discrete, to
system monitoring. It is extremely well suited for discrete applications,
and handles very large amounts of digital signals and alarm bursts. Its
advanced Client/Sever architecture makes it easy to start small and expand
your system.
 
Description
----------------
A heap overflow exists in a mandatory component in Cimplicity, which can be
triggered remotely without authentication.
The vulnerability was exploited by C4 to verify it can be used for arbitrary
code execution by an unauthorized attacker.
The description of the vulnerability is intentionally limited as this
software controls critical national infrastructure.
 
Impact
----------
An attacker can compromise the Cimplicity 6.1 control server, and each of
the operator workstations.
 
Affected Versions
-------------------------
Cimplicity HMI 6.1 
Cimplicity HMI 6.1 SP5
Cimplicity HMI 6.1 SP6
Previous versions may be vulnerable, as they were not tested.
 
Workaround/Fix
-----------------------
The vendor issued a hotfix to resolve this vulnerability 
 
Additional Information
-------------------------------
For additional information please contact us at info@c4-security.com. Note
that we will respond only to verified utility personnel and governmental
agencies.
The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0176
 
Credit
--------
This vulnerability was discovered and exploited by Gilad Bakas and Eyal
Udassin of C4.
 
Regards,
 
Eyal Udassin - C4 (Formerly Swift Coders)
33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel
eyal.udassin@c4-security.com / www.c4-security.com
<http://www.c4-security.com/> 
+972-547-684989

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC