ID

VAR-200809-0017

CVE

CVE-2008-2474

TITLE

ABB PCU400 "x87" Buffer Overflow Vulnerability

DESCRIPTION

Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitrary code via a crafted packet using the (1) IEC60870-5-101 or (2) IEC60870-5-104 communication protocol to the X87 web interface. ABB PCU400 contains a vulnerability which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. ABB Made by company PCU400 Contains a buffer overflow vulnerability. ABB Provided by the company PCU400 Application server IEC-870-5-104 Use protocol RTU(Remote Terminal Unit) When SCADA A gateway device that communicates between servers. The PCU400 'x87' executable version 3.5.5 is vulnerable; other versions may also be affected. Background ----------------- Vendor product information: PCU400 is the modern product when implementing an effective data acquisition network in SCADA-based systems PCU400, Process Communication Unit 400 forms the communication interface to the network of remote terminal units (RTUs) together with the RCS Application Software located in the application server of a Network Manager SCADA system. The PCU400 can be used as a SCADA front-end, communication gateway for Substation Automation systems or as a standalone protocol converter. Two parts define the Data Acquisition system: * RCS Application, a software package running in the Application Server * PCU400, a front-end converter that implements the protocols and connects the physical lines PCU 400 can be used in a variety of configurations to cater for different network topologies and different levels of fault tolerance in the system. The alternatives include single or redundant PCU 400 units. Description ---------------- A buffer overflow exists in the component that handles IEC60870-5-101 and IEC60870-5-104 communication protocols. The description of the vulnerability is intentionally limited as this software controls critical national infrastructure. Impact ---------- An attacker can compromise the server which runs PCU400, which acts as the FEP server of the ABB SCADA system. This vulnerability is another method to carry out the "field to control center" attack vector mentioned in C4's S4 2008 paper "Control System Attack Vectors and Examples: Field Site and Corporate Network", which will allow the attacker to control other RTUs connected to that FEP. In addition, an attacker can use his control over the FEP server to insert a generic electric grid malware as specified in our SysScan08 presentation, in order to cause harm to the grid. Both documents are available at http://www.c4-security.com/index-5.html . Workaround/Fix ----------------------- The vendor issued a hotfix to resolve this vulnerability. Additional Information ------------------------------- For additional information please contact us at info_at_c4-security.com. Note that we will respond only to verified utility personnel and governmental agencies. The CVE identifier assigned to this vulnerability by CERT is CVE-2008-2474 Credit -------- This vulnerability was discovered and exploited by Idan Ofrat of C4. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: ABB PCU400 X87 Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA32047 VERIFY ADVISORY: http://secunia.com/advisories/32047/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From local network SOFTWARE: ABB PCU 400 http://secunia.com/advisories/product/19970/ DESCRIPTION: A vulnerability has been reported in ABB PCU400, which can potentially be exploited by malicious people to compromise a vulnerable system. PROVIDED AND/OR DISCOVERED BY: Idan Ofrat of C4 Security ORIGINAL ADVISORY: C4 Security: http://archives.neohapsis.com/archives/bugtraq/2008-09/0283.html OTHER REFERENCES: US-CERT VU#343971: http://www.kb.cert.org/vuls/id/343971 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Buffer overflow

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Eyal Udassin and Idan Ofrat of C4 Security

SOURCES

LAST UPDATE DATE

2025-04-10T23:24:56.412000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE