Vulnerabilities in some SCADA server softwares



The following are almost all the vulnerabilities I found for a quick
experiment some months ago in certain well known server-side SCADA
softwares still vulnerable in this moment.

In case someone doesn't know SCADA (like me before the tests): it's
just one or more softwares (usually a core, a graphical part and a
database) that allow people to monitor and control the various hardware
sensors and mechanisms located in industrial environments like nuclear
plants, refineries, gas pipelines, airports and other less and more
critical fields that go from the energy to the public infrastructures
and obviously also the small "normal" industries.

In technical terms the SCADA software is just the same as any other
software used everyday, so with inputs (in this case they are servers
so the input is the TCP/IP network) and vulnerabilities: stack and heap
overflows, integer overflows, arbitrary commands execution, format
strings, double and arbitrary memory frees, memory corruptions, directory
traversals, design problems and various other bugs.

Full-disclosure advisories and proof-of-concepts:

Siemens Tecnomatix FactoryLink:
http://aluigi.org/adv/factorylink_1-adv.txt
http://aluigi.org/adv/factorylink_2-adv.txt
http://aluigi.org/adv/factorylink_3-adv.txt
http://aluigi.org/adv/factorylink_4-adv.txt
http://aluigi.org/adv/factorylink_5-adv.txt
http://aluigi.org/adv/factorylink_6-adv.txt (DoS only)

Iconics GENESIS32 and GENESIS64:
http://aluigi.org/adv/genesis_1-adv.txt
http://aluigi.org/adv/genesis_2-adv.txt
http://aluigi.org/adv/genesis_3-adv.txt
http://aluigi.org/adv/genesis_4-adv.txt
http://aluigi.org/adv/genesis_5-adv.txt
http://aluigi.org/adv/genesis_6-adv.txt
http://aluigi.org/adv/genesis_7-adv.txt
http://aluigi.org/adv/genesis_8-adv.txt
http://aluigi.org/adv/genesis_9-adv.txt
http://aluigi.org/adv/genesis_10-adv.txt
http://aluigi.org/adv/genesis_11-adv.txt
http://aluigi.org/adv/genesis_12-adv.txt
http://aluigi.org/adv/genesis_13-adv.txt

7-Technologies IGSS (Interactive Graphical SCADA System):
http://aluigi.org/adv/igss_1-adv.txt
http://aluigi.org/adv/igss_2-adv.txt
http://aluigi.org/adv/igss_3-adv.txt
http://aluigi.org/adv/igss_4-adv.txt
http://aluigi.org/adv/igss_5-adv.txt
http://aluigi.org/adv/igss_6-adv.txt
http://aluigi.org/adv/igss_7-adv.txt
http://aluigi.org/adv/igss_8-adv.txt

DATAC RealWin:
http://aluigi.org/adv/realwin_2-adv.txt
http://aluigi.org/adv/realwin_3-adv.txt
http://aluigi.org/adv/realwin_4-adv.txt
http://aluigi.org/adv/realwin_5-adv.txt
http://aluigi.org/adv/realwin_6-adv.txt
http://aluigi.org/adv/realwin_7-adv.txt
http://aluigi.org/adv/realwin_8-adv.txt


---
Luigi Auriemma
http://aluigi.org



Relevant Pages

  • Re: Vulnerabilities in some SCADA server softwares
    ... personal time and skills to find these vulnerabilities and reporting ... even with the obligation of doing everything the vendor wants before ... Vulnerability Description Over 300 ActiveX based vulnerabilities have ... as nothing more than juvenile idiocy to release SCADA based bugs. ...
    (Bugtraq)
  • Help with Guide to finding Vulnerability
    ... research on vulnerabilities.. ... and other softwares) .. ... what should I know or have the skills in terms of below mentioned. ... Security Trends Report from Cenzic ...
    (Pen-Test)
  • Help with Guide to finding Vulnerability
    ... research on vulnerabilities.. ... vulnerability in various web products (such as PhpMyAdmin, Apache ... and other softwares) .. ... what should I know or have the skills in terms of below mentioned. ...
    (Security-Basics)