GE Fanuc CIMPLICITY HMI heap buffer overflow

Overview

GE Fanuc CIMPLICITY HMI contains a remotely accessible heap buffer overflow vulnerability which may allow a remote attacker to execute arbitrary code.

Description

GE Fanuc CIMPLICITY HMI is software used for monitoring and control in Supervisory Control And Data Acquisition (SCADA) systems. A heap buffer overflow vulnerability exists in a CIMPLICITY process (w32rtr.exe) that listens on the network (32000/tcp). The vulnerable process exists in both servers and clients. An attacker could exploit this vulnerability by sending a specially crafted packet to a vulnerable CIMPLICITY system.

Note that this vulnerability affects GE Fanuc CIMPLICITY HMI versions up to and including version 7.0.

---

Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial of service.

---

Solution

Apply Patch

This vulnerability is addressed in CIMPLICITY 6.1 SP6 Hot fix - 010708_162517_6106 and CIMPLICITY 7.0 SIM 9. CIMPLICITY customers should refer to GE Fanuc knowledge base article KB2458 for more information.

Upgrade

Users of affected software with versions older than 6.1 are encouraged to upgrade to 6.1 or greater and then apply the patches described above. CIMPLICITY customers should refer to GE Fanuc knowledge base article KB12458 for more information.

---

Restrict Access

Restrict network access to hosts that require connections to CIMPLICITY. Do not allow access to CIMPLICITY from untrusted networks such as the internet.

---

Vendor Information

308556

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

GE Fanuc __ Affected

Notified: December 20, 2007 Updated: January 24, 2008

Status

Affected

Vendor Statement

A product SIM has been created and is available on the GE Fanuc Support Web Site. For more information please consult KB12458.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

We have no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23308556 Feedback>).

CVSS Metrics

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental		N/A

References

• <http://www.securityfocus.com/archive/1/487076/30/0/threaded&gt;
• http://support.gefanuc.com/support/index?page=kbchannel&id=KB12458
• <http://www.gefanuc.com/as_en/gefanuc/resource_center/hmi_scada/hmiscada_security.html&gt;

Acknowledgements

This vulnerability was reported by Eyal Udassin of C4 Security.

This document was written by Chris Taschner.

Other Information

CVE IDs:	CVE-2008-0176
Severity Metric:	3.01 Date Public: