7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.006 Low
EPSS
Percentile
78.4%
ICS-CERT originally released Advisory ICSA-11-277-01P on the US-CERT secure Portal on October 04, 2011. This web page release was delayed to allow users sufficient time to download and install the update.
Researcher Kuang-Chun Hung of Security Research and Service Institute—Information and Communication Security Technology Center (ICST) has identified a buffer overflow vulnerability in UnitelWay Windows Device Driver. This device driver is deployed as part of several different Schneider Electric products.
ICS-CERT has coordinated this vulnerability report with Schneider Electric. The vendor has produced a fix that resolves this vulnerability. ICST has successfully tested and validated that this fix fully resolves this vulnerability.
The following software packages are affected:
|
|
—|—|—
Unity Pro | Version 6 and prior | Windows XP
OPC Factory Server | Version 3.34 | Windows XP
Vijeo Citect | Version 7.20 and prior | Windows XP
Telemecanique Driver Pack | Version 2.6 and prior | Windows XP
Monitor Pro | Version 7.6 and prior | Windows XP
PL7 Pro | Version 4.5 and prior | Windows XP
These six products are known to have the vulnerable UnitelWay Windows Device Driver and are elements of Schneider Electric SoCollaborative software components. These components are part of Schneider Electric process automation architecture known as PlantStruxure.
Exploitation of this vulnerability will allow an attacker to run arbitrary code on the targeted system. Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their environment, architecture, and product implementation.
Schneider Electric is a manufacturer and integrator of energy management equipment and software. Schneider Electric systems are found in the energy, manufacturing, building automation, and information technology. Schneider Electric reports operations in over 100 countries worldwide.
An oversized input string to a parameter in this system using the UnitelWay Windows Device Driver causes a buffer overflow that allows arbitrary code execution.
CVE-2011-3330 has been assigned to this vulnerability.
This vulnerability is not remotely exploitable.
No known exploits specifically target this vulnerability.
An attacker with a low skill level can create a denial of service whereas it would require a more skilled attacker to execute arbitrary code.
Schneider Electric has created a fix that modifies one of the libraries of the UnitelWay Windows Device Driver. Schneider Electric has also issued a customer notification describing the vulnerability.Vulnerability within UnitelWay Windows Device Driver, http://www.scada.schneider-electric.com/sites/scada/en/login/vijeo-citect-unitelway-windows-device-driver.page, website last accessed October 20, 2011. Schneider Electric recommends that since the functionality of the existing version is not affected by the installation of the fix, all customers should install the fix, which is available at the following address: www.scada.schneider-electric.com/download/security/HFPEP0047398R.zip
Schneider Electric recommends that customers requiring additional assistance contact their global support center or a local customer service center. Contact information is available at the following web addresses.
Vijeo Citect customers should contact Schneider Electric’s SCADA and MES Software Support Center.
Customers of all other affected Schneider Electric products should contact their local support center.
In addition to applying the fix developed by Schneider Electric, ICS-CERT encourages asset owners to take additional defensive measures against this and other cybersecurity threats by:
ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.
The Control Systems Security Program (CSSP) also provides a recommended practices section for control systems on the CSSP web page. Several recommended practices are available for reading or download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3330
www.scada.schneider-electric.com/download/security/HFPEP0047398R.zip
www.scada.schneider-electric.com/sites/scada/en/login/country-support.page
www2.schneider-electric.com/sites/corporate/en/support/operations/local-operations/local-operations.page
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=Schneider%20Electric%20UnitelWay%20Buffer%20Overflow+https://www.cisa.gov/news-events/ics-advisories/icsa-11-277-01
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-11-277-01&title=Schneider%20Electric%20UnitelWay%20Buffer%20Overflow
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-11-277-01
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-11-277-01
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Schneider%20Electric%20UnitelWay%20Buffer%20Overflow&body=www.cisa.gov/news-events/ics-advisories/icsa-11-277-01