7.2 High
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
7.3 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
0.4%
Independent researcher Carlos Mario Penagos Hollmann identified a remotely exploitable, uncontrolled search path element vulnerability, commonly referred to as a DLL hijack, in Measuresoft’s ScadaPro application. Measuresoft has produced an upgrade to address this vulnerability. Mr. Hollmann has verified that the new version resolves the vulnerability.
The following Measuresoft products are affected:
Successful exploitation of this vulnerability may lead to arbitrary code execution.
Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.
ScadaPro is a supervisory control and data acquisition (SCADA) system used in the power generation, oil and gas, pharmaceuticals, and manufacturing sectors. According to Measuresoft, ScadaPro is sold in multiple countries by various third-party distributors, making total deployment difficult to quantify.
Measuresoft Development Ltd. is headquartered in Louth, Ireland, with an office in Missouri City, Texas.
ScadaPro uses a fixed or controlled search path to find resources, which could allow an unauthorized user to easily locate and exploit one or more locations. An unauthorized user could place a malicious DLL in a directory where it could be loaded before the valid DLL. An attacker must have access to the host file system to exploit this vulnerability. If exploited, this vulnerability could allow execution of arbitrary code.
CVE-2012-1824NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1824, NIST uses this ICS-CERT Advisory to create the CVE Web site report. This Web site will be active sometime after publication of this advisory. has been assigned to this vulnerability. A CVSS v2 base score of 6 has been assigned; the CVSS vector string is (AV:L/AC:H/Au:S/C:C/I:C/A:C).
This vulnerability can be remotely exploited.
No known public exploits specifically target this vulnerability.
An attacker with a moderate skill level could be able to exploit these vulnerabilities.
Measuresoft has produced an upgrade to address this vulnerability. Links to the upgrade can be found here:
Microsoft has also released a Security Advisory (2269637).Microsoft Security Advisory, http://technet.microsoft.com/en-us/security/advisory/2269637, Web site visited May 25, 2012.
ICS-CERT encourages asset owners to take additional defensive measures to protect against this and other cybersecurity risks.
The Control Systems Security Program (CSSP) also provides a section for control systems security recommended practices on the CSSP web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
nvd.nist.gov/cvss.cfm?version=2&vector=(AV:L/AC:H/Au:S/C:C/I:C/A:C),
www.measuresoft.net/download/versions.aspx?v=CB&d=Client
www.measuresoft.net/download/versions.aspx?v=CB&d=Server
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=Measuresoft%20ScadaPro%20DLL%20Hijack+https://www.cisa.gov/news-events/ics-advisories/icsa-12-145-01
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-12-145-01&title=Measuresoft%20ScadaPro%20DLL%20Hijack
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-12-145-01
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-12-145-01
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Measuresoft%20ScadaPro%20DLL%20Hijack&body=www.cisa.gov/news-events/ics-advisories/icsa-12-145-01