[NEWS] GE Fanuc Cimplicity Heap Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



GE Fanuc Cimplicity Heap Overflow
------------------------------------------------------------------------


SUMMARY

CIMPLICITY is "a powerful and technically advanced HMI/SCADA product. With
its open system design approach, true client/server architecture, and the
latest web technologies, CIMPLICITY allows you to realize the benefits of
digitization for the collection, monitoring, supervisory control and
sharing of critical process and production data throughout your operations
CIMPLICITY has been used in all industries -- from process to discrete, to
system monitoring. It is extremely well suited for discrete applications,
and handles very large amounts of digital signals and alarm bursts. Its
advanced Client/Sever architecture makes it easy to start small and expand
your system".

A remote exploitable heap overflow in the GE Fanuc Cimplicity product
allows remote attackers to cause the product to execute arbitrary code.

DETAILS

Vulnerable Systems:
* Cimplicity HMI version 6.1
* Cimplicity HMI version 6.1 SP5
* Cimplicity HMI version 6.1 SP6

A heap overflow exists in a mandatory component in Cimplicity, which can
be triggered remotely without authentication. The vulnerability was
exploited and can be used for arbitrary code execution by an unauthorized
attacker.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0176>
CVE-2008-0176


ADDITIONAL INFORMATION

The information has been provided by
<mailto:eyal.udassin@xxxxxxxxxxxxxxx> Eyal Udassin.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Cross Application Scripting in Trend Micros Antivirus Software
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The SecuriTeam alerts list - Free, Accurate, Independent. ... When the product alerts the user of a possible virus, it creates an HTML ...
    (Securiteam)
  • [NT] Microsoft Windows NTFS Improper Handler Closing
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... from a system shutdown, uninitialized data may be visible in files from ...
    (Securiteam)
  • [TOOL] tcpstatflow - Covert Tunnel Detector
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... For example, he could set up a SSH server on the Internet, listening port ... one way and the opposite (within a single TCP connection). ...
    (Securiteam)
  • [EXPL] Eudora Attachment Spoof Exploit Revisited
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... present in the newest release of Eudora. ... Can be exploited if there is more than one way into attach: in my setup ...
    (Securiteam)
  • [UNIX] Phorum SQL Injection (userlogin.php)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An SQL injection vulnerability exists in the 'userlogin.php' script. ... the MD5 hash of the user one character at a time. ...
    (Securiteam)