RealFlex RealWin buffer overflow

Overview

RealFlex RealWin demo version contains a vulnerability in the way “FC_INFOTAG/SET_CONTROL” packets are processed.

Description

RealFlex RealWin is SCADA server software that includes a Human Machine Interface (HMI) componant and runs on Microsoft Windows 2000 or XP. The demo version of RealWin contains a stack overflow in the way malicious “FC_INFOTAG/SET_CONTROL” packets are processed. According to Reversemode:

The bug is a classic stack overflow while processing a specially crafted FC_INFOTAG/SET_CONTROL packet. RealWin server accepts connections from FlewWin clients which use a propietary protocol. We can exploit this flaw from remote without having valid credentials.

Note that the non-demo version of RealWin has encryption protocol methods in place which calculate length of transmitted/received packets, preventing this buffer overflow.

---

Impact

This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service.

---

Solution

Update
RealFlex has made a fixed version of the demo software available to address this issue. See http://www.realflex.com/download/form.php for more information.

---

Restrict Access

Restrict network access to hosts that require connections to the demo version of RealWin. Do not allow access to RealWin from untrusted networks such as the internet.

---

Vendor Information

It appears that RealFlex (including RealWin and other products) was spun off from from DATAC (also known as: DCIL, DATAC Control International, Ltd., DATACONLINE) and that DATAC remains a licensed distributor of RealWin and other RealFlex products.

---

976484

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

DatacOnline Affected

Updated: December 02, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

DatacOnline Affected

Notified: November 13, 2008 Updated: December 18, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

RealFlex Affected

Updated: December 18, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base	0	AV:–/AC:–/Au:–/C:–/I:–/A:–
Temporal	0	E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)
Environmental	0	CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)

References

• <http://secunia.com/advisories/32055/&gt;
• <http://www.realflex.com/products/realwin/realwin.php&gt;
• <http://www.dataconline.com/software/realwin.php&gt;
• <http://www.dataconline.com/profile/profile.php&gt;
• <http://www.realflex.com/profile/history.php&gt;
• http://reversemode.com/index.php?option=com_content&task=view&id=55&Itemid=1

Acknowledgements

This issue was reported by Ruben Santamarta of Reversemode.

This document was written by Chris Taschner.

Other Information

CVE IDs:	CVE-2008-4322
Severity Metric:	2.48 Date Public: