ICS-CERT: ABB Multiple Components Buffer Overflow

Wednesday, April 11, 2012

Infosec Island Admin

7fef78c47060974e0b8392e305f0daf0

Independent researchers Terry McCorkle and Billy Rios identified a buffer overflow vulnerability in multiple components of the ABB WebWare Server application. These components have been found to contain vulnerabilities in the COM and scripting interfaces.

Follow-up investigation by ABB showed that these components are used in multiple ABB legacy products. Because these are legacy products nearing the end of their life cycle, ABB does not intend to patch these vulnerable components.

The following ABB products are affected:

• WebWare Server: All versions of Data Collector and Interlink
• WebWare SDK: All versions
• ABB Interlink Module: All versions
• S4 OPC Server: All versions
• QuickTeach: All versions
• RobotStudio S4: All versions
• RobotStudio Lite: All versions

IMPACT

Successfully exploiting these vulnerabilities could lead to a denial-of-service for the application and privilege escalation or could allow an attacker to execute arbitrary code.

Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

BACKGROUND

The legacy WebWare software products include a number of COM and ActiveX controls. These controls are delivered and installed together in the above products to facilitate communications with the robot controller or the WebWare Server and may run as services on the PC. Other controls provide graphical elements for web pages and custom human-machine interfaces (HMIs).

The above products are used in several different roles in a factory environment. WebWare Server is used for data gathering and backup handling. WebWare SDK, ABB Interlink Module, and S4 OPC Server are used for HMIs and communications to and from a robot controller. QuickTeach, RobotStudio S4, and RobotStudio Lite are PC tools used for training, installation, and programming of a robot cell.

VULNERABILITY OVERVIEW

According to independent researchers Terry McCorkle and Billy Rios, multiple components of the ABB WebWare Server application contain a buffer overflow vulnerability. According to ABB, the legacy PC products WebWare Server, WebWare SDK, and other legacy products that include parts of WebWare contain a number of COM and ActiveX components that have been found to contain vulnerabilities in the COM and scripting interfaces. Follow-up investigation by ABB showed that these components are used in multiple ABB platforms.

STACK-BASED BUFFER OVERFLOW: The COM and ActiveX controls included in the software do not provide adequate checking of input data. A user or program could call one of the controls’ interfaces with specially crafted input data that can overflow the stack pointer or cause the control to stop execution. The ActiveX controls have been registered as scriptable, which means that they can be included and scripted from remotely served web pages. CVE-2012-1801 has been assigned to this vulnerability. According to ABB, a CVSS Overall Score of 7.7 has also been assigned.

EXPLOITABILITY: The vulnerability in these components is remotely exploitable.

EXISTENCE OF EXPLOIT: No known exploits specifically target these vulnerable components.

DIFFICULTY: Crafting a working exploit for this vulnerability requires a medium skill level.

MITIGATION

According to ABB, the WebWare Server and the products listed above are legacy products nearing the end of their life cycle that are no longer actively supported. Users of these products are directed to the available documentation on mitigating risk and securing their machines and production environments. Because these are legacy products, ABB does not intend to patch these vulnerable components.

ABB has released a customer advisory that can be found here:

ABB has also released a whitepaper on WebWare Component security that can be found here:

ABB would like to direct customers using the affected products to review the above documents and implement the recommendations provided.

ABB customers using these products may contact their local ABB Robotics service organization (see www.abb.com for information). Questions or responses on cybersecurity may be addressed to mailto:cybersecurity@ch.abb.com.

The full ICS-CERT advisory can be found here:

Source:  http://www.us-cert.gov/control_systems/pdf/ICSA-12-095-01A.pdf

Possibly Related Articles:
14098
SCADA
Industrial Control Systems
Denial of Service SCADA Vulnerabilities Buffer Overflow Privilege Escalation Advisory ICS-CERT Industrial Control Systems ABB WebWare
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.