C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow

Background

Vendor product information:
CIMPLICITY is a powerful and technically advanced HMI/SCADA product. With
its open system design approach, true client/server architecture, and the
latest web technologies, CIMPLICITY allows you to realize the benefits of
digitization for the collection, monitoring, supervisory control and sharing
of critical process and production data throughout your operations
CIMPLICITY has been used in all industries – from process to discrete, to
system monitoring. It is extremely well suited for discrete applications,
and handles very large amounts of digital signals and alarm bursts. Its
advanced Client/Sever architecture makes it easy to start small and expand
your system.

Description

A heap overflow exists in a mandatory component in Cimplicity, which can be
triggered remotely without authentication.
The vulnerability was exploited by C4 to verify it can be used for arbitrary
code execution by an unauthorized attacker.
The description of the vulnerability is intentionally limited as this
software controls critical national infrastructure.

Impact

An attacker can compromise the Cimplicity 6.1 control server, and each of
the operator workstations.

Affected Versions

Cimplicity HMI 6.1
Cimplicity HMI 6.1 SP5
Cimplicity HMI 6.1 SP6
Previous versions may be vulnerable, as they were not tested.

Workaround/Fix

The vendor issued a hotfix to resolve this vulnerability

Additional Information

For additional information please contact us at [email protected]. Note
that we will respond only to verified utility personnel and governmental
agencies.
The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0176

Credit

This vulnerability was discovered and exploited by Gilad Bakas and Eyal
Udassin of C4.

Regards,

Eyal Udassin - C4 (Formerly Swift Coders)
33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel
[email protected] / www.c4-security.com
<http://www.c4-security.com/&gt;
+972-547-684989