C4 Security Advisory - GE Fanuc Cimplicity 6.1 Heap Overflow

["Eyal Udassin" <eyal.udassin () c4-security com>]

Background
-----------------
Vendor product information:
CIMPLICITY is a powerful and technically advanced HMI/SCADA product. With
its open system design approach, true client/server architecture, and the
latest web technologies, CIMPLICITY allows you to realize the benefits of
digitization for the collection, monitoring, supervisory control and sharing
of critical process and production data throughout your operations
CIMPLICITY has been used in all industries -- from process to discrete, to
system monitoring. It is extremely well suited for discrete applications,
and handles very large amounts of digital signals and alarm bursts. Its
advanced Client/Sever architecture makes it easy to start small and expand
your system.
 
Description
----------------
A heap overflow exists in a mandatory component in Cimplicity, which can be
triggered remotely without authentication.
The vulnerability was exploited by C4 to verify it can be used for arbitrary
code execution by an unauthorized attacker.
The description of the vulnerability is intentionally limited as this
software controls critical national infrastructure.
 
Impact
----------
An attacker can compromise the Cimplicity 6.1 control server, and each of
the operator workstations.
 
Affected Versions
-------------------------
Cimplicity HMI 6.1 
Cimplicity HMI 6.1 SP5
Cimplicity HMI 6.1 SP6
Previous versions may be vulnerable, as they were not tested.
 
Workaround/Fix
-----------------------
The vendor issued a hotfix to resolve this vulnerability 
 
Additional Information
-------------------------------
For additional information please contact us at info () c4-security com. Note
that we will respond only to verified utility personnel and governmental
agencies.
The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0176
 
Credit
--------
This vulnerability was discovered and exploited by Gilad Bakas and Eyal
Udassin of C4.
 
Regards,
 
Eyal Udassin - C4 (Formerly Swift Coders)
33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel
eyal.udassin () c4-security com / www.c4-security.com
<http://www.c4-security.com/> 
+972-547-684989