C4 SCADA Security Advisory - AREVA e-terrahabitat / e-terraplatform Multiple Vulnerabilities
- From: "Eyal Udassin" <eyal.udassin@xxxxxxxxxxxxxxx>
- Date: Thu, 5 Feb 2009 18:46:38 +0200
Vendor product information, from www.areva-td.com :
AREVA T&D solution for real-time energy management systems; this suite of
software products can be configured to meet your specific needs and
business function. Transmission companies, Generation owners, Independent
System Operators and vertically integrated utilities can all benefit from
new features and functionality of e-terraplatform. All configurations of
share a robust, portable and flexible foundation: highly available
real-time database, a high performance user interface, a comprehensive
modeling environment and a historical information system.
Due to the sensitivity of SCADA security vulnerabilities, we can only
publicly disclose that multiple elements of the e-terraplatform suffer from
multiple vulnerabilities ranging from Denial of Service to Privilege
Details of these vulnerabilities will be disclosed only to legitimate
parties such as asset owners (utilities), after receiving the approval of
the local CERT or any other local official entity.
An attacker can exploit these vulnerabilities in order to:
1. Halt the system's operation (Denial of Service)
2. Gain unauthorized access with high privileges to the system
3. Leverage these vulnerabilities to attempt to find additional
vulnerabilities in the server to carry out the "corporate network to control
center" and "field to control center" attack vectors mentioned in C4's S4
2008 paper "Control System Attack Vectors and Examples: Field Site and
e-terrahabitat version 5.5.x
e-terrahabitat version 5.6.x
e-terrahabitat version 5.7.x
The vendor issued a security patch to address these vulnerabilities.
For additional information please contact us at info_at_c4-security.com.
Note that we will respond only to verified utility personnel and
Details of this vulnerability will be disclosed only to legitimate parties
such as asset owners (utilities), after receiving the approval of the local
CERT or any other local official entity.
The CVE identifiers assigned to these vulnerabilities by CERT are:
These vulnerabilities were discovered and exploited by Jonathan Afek and
Eyal Udassin from C4 Security (http://www.c4-security.com).
C4 Security is a leader in SCADA security reviews, auditing and penetration
Eyal Udassin - C4
33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel
eyal.udassin@xxxxxxxxxxxxxxx / <http://www.c4-security.com/>
- Prev by Date: Re: SMF 1.1.7 Persistent XSS (requires permision to edit censor)
- Next by Date: dBpowerAMP Audio Player local buffer overflow exploit
- Previous by thread: [SVRT-02-09] FeedDemon (ver<=2.7) Buffer Overflow Vulnerability
- Next by thread: dBpowerAMP Audio Player local buffer overflow exploit