ICS-CERT: Open Automation Software OPC Systems Vulnerability

Friday, January 13, 2012

Headlines

69dafe8b58066478aea48f3d0f384820

This Advisory is a follow-up to “ICS-ALERT-11-285-01—Open Automation Software OPC Systems.NET vulnerability” that was posted on the ICS-CERT website on October 12, 2011.

Independent researcher Luigi Auriemma publicly reported a malformed packet vulnerability in Open Automation Software’s OPC Systems.NET along with proof-of-concept (PoC) exploit code. This public report was released without coordination with Open Automation Software, ICS-CERT, or any other coordinating entity known to ICS-CERT.

ICS-CERT has coordinated this vulnerability with Open Automation Software, and they have produced an update that resolves this vulnerability. Luigi Auriemma has tested the update and has confirmed that it resolves the vulnerability.

AFFECTED PRODUCTS

All versions of OPC Sytems.NET prior to Version 5.0 are affected.

IMPACT

A malformed packet could be sent remotely to cause a denial of service. Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their environment, architecture, and product implementation.

BACKGROUND

Open Automation Software is a US-based company that provides .NET products for supervisory control and data acquisition (SCADA) and human-machine interfaces (HMI) applications.

According to Open Automation Software, OPC Systems.NET is an HMI application that is deployed across several sectors including manufacturing, information technology, energy, water and wastewater, defense, and others. Open Automation Software estimates that these products are used throughout the world with primary use in the United States.

VULNERABILITY OVERVIEW

The vulnerability is exploitable by sending a malformed .NET Remote Procedural Call (RPC) packet to cause a denial of service through Port 58723/TCP. CVE-2011-4871 has been assigned to this vulnerability.

EXPLOITABILITY

This vulnerability is remotely exploitable.

EXISTENCE OF EXPLOIT

Public exploits are known to target this vulnerability.

DIFFICULTY

Crafting a working exploit for this vulnerability requires moderate skill.

MITIGATION

Open Automation Software has released OPC Systems.NET Version 5.0 that resolves the reported vulnerability by removing the vulnerable component. Customers with vulnerable versions of Open Automation Software OPC Sytems.NET should deploy the update, which is available at: http://www.opcsystems.com/downloads.htm.

View the full ICS-CERT advisory here:

Source:  http://www.us-cert.gov/control_systems/pdf/ICSA-12-012-01.pdf

Possibly Related Articles:
10723
US-CERT
Denial of Service SCADA Application Security Vulnerabilities Exploits Headlines Advisory ICS ICS-CERT Luigi Auriemma PC Systems.NET
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.