Sign-up

ID

VAR-201102-0181


CVE

CVE-2010-4740


TITLE

SCADA engine BACnet OPC Client Buffer Overflow Vulnerability

Trust: 1.8

sources: IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1 // IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d // CERT/CC: VU#660688 // CNVD: CNVD-2010-2060

DESCRIPTION

Stack-based buffer overflow in WTclient.dll in SCADA Engine BACnet OPC Client before 1.0.25 allows user-assisted remote attackers to execute arbitrary code via a crafted .csv file, related to a status log message. This vulnerability WTclient.dll Due to the library. SCADA is the data acquisition and monitoring control system. BACnet OPC Client is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Failed exploit attempts will likely result in denial-of-service conditions. ---------------------------------------------------------------------- Windows Applications Insecure Library Loading The Official, Verified Secunia List: http://secunia.com/advisories/windows_insecure_library_loading/ The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected. ---------------------------------------------------------------------- TITLE: SCADA Engine BACnet OPC Client Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA41466 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/41466/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=41466 RELEASE DATE: 2010-09-18 DISCUSS ADVISORY: http://secunia.com/advisories/41466/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/41466/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=41466 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been discovered in SCADA Engine BACnet OPC Client, which can be exploited by malicious people to compromise a user's system. tricking a user into opening a specially crafted *.csv file. The vulnerability is confirmed in version 1.0.24. Other versions may also be affected. SOLUTION: Do not open untrusted files. PROVIDED AND/OR DISCOVERED BY: Jeremy Brown OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.6

sources: NVD: CVE-2010-4740 // CERT/CC: VU#660688 // JVNDB: JVNDB-2011-001152 // CNVD: CNVD-2010-2060 // BID: 43289 // IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1 // IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d // PACKETSTORM: 93978

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.0

sources: IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1 // IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d // CNVD: CNVD-2010-2060

AFFECTED PRODUCTS

vendor:scadamodel:engine bacnet opc clientscope:eqversion:1.0.24

Trust: 1.0

vendor:scadaenginemodel:bacnet opc clientscope:lteversion:1.0.24

Trust: 1.0

vendor:scada enginemodel: - scope: - version: -

Trust: 0.8

vendor:scada enginemodel:bacnet opc clientscope:eqversion:version 1.0.24

Trust: 0.8

vendor:scadaenginemodel:bacnet opc clientscope:eqversion:1.0.24

Trust: 0.6

sources: IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1 // IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d // CERT/CC: VU#660688 // CNVD: CNVD-2010-2060 // JVNDB: JVNDB-2011-001152 // CNNVD: CNNVD-201102-232 // NVD: CVE-2010-4740

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-4740
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#660688
value: 3.22

Trust: 0.8

NVD: CVE-2010-4740
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201102-232
value: CRITICAL

Trust: 0.6

IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1
value: HIGH

Trust: 0.2

IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2010-4740
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

sources: IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1 // IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d // CERT/CC: VU#660688 // JVNDB: JVNDB-2011-001152 // CNNVD: CNNVD-201102-232 // NVD: CVE-2010-4740

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2011-001152 // NVD: CVE-2010-4740

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201102-232

TYPE

Buffer overflow

Trust: 1.0

sources: IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1 // IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201102-232

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-001152

PATCH
title:Distributorsurl:http://www.scadaengine.com/distributor.html
Trust: 0.8
title:SCADA Engine - Downloadsurl:http://www.scadaengine.com/downloads.html
Trust: 0.8
title:SCADA Engine - Homeurl:http://www.scadaengine.com/index.html
Trust: 0.8
title:Patch for SCADA Engine BACnet OPC Client Buffer Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/3032
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2010-2060 // 
            
            
            
            JVNDB: JVNDB-2011-001152

EXTERNAL IDS
db:SECUNIAid:41466
Trust: 3.9
db:BIDid:43289
Trust: 3.5
db:ICS CERTid:ICSA-10-264-01
Trust: 3.2
db:CERT/CCid:VU#660688
Trust: 3.2
db:NVDid:CVE-2010-4740
Trust: 2.7
db:CNVDid:CNVD-2010-2060
Trust: 1.0
db:SREASONid:8083
Trust: 1.0
db:JVNDBid:JVNDB-2011-001152
Trust: 0.8
db:CNNVDid:CNNVD-201102-232
Trust: 0.6
db:IVDid:7D7A45C1-463F-11E9-BBB9-000C29342CB1
Trust: 0.2
db:IVDid:8CB14B48-1FAE-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:PACKETSTORMid:93978
Trust: 0.1
sources:
            
            
            IVD: 7d7a45c1-463f-11e9-bbb9-000c29342cb1 // 
            
            
            
            IVD: 8cb14b48-1fae-11e6-abef-000c29c66e3d // 
            
            
            
            CERT/CC: VU#660688 // 
            
            
            
            CNVD: CNVD-2010-2060 // 
            
            
            
            BID: 43289 // 
            
            
            
            JVNDB: JVNDB-2011-001152 // 
            
            
            
            PACKETSTORM: 93978 // 
            
            
            
            CNNVD: CNNVD-201102-232 // 
            
            
            
            NVD: CVE-2010-4740

REFERENCES
url:http://www.securityfocus.com/bid/43289
Trust: 3.2
url:http://www.us-cert.gov/control_systems/pdf/icsa-10-264-01.pdf
Trust: 3.2
url:http://secunia.com/advisories/41466
Trust: 2.4
url:http://www.kb.cert.org/vuls/id/660688
Trust: 2.4
url:http://packetstormsecurity.org/1009-exploits/bacnet-overflow.py.txt
Trust: 1.6
url:http://secunia.com/advisories/41466/
Trust: 1.5
url:http://securityreason.com/securityalert/8083
Trust: 1.0
url:http://www.scadaengine.com/software1.html
Trust: 0.8
url:http://www.scadaengine.com/downloads.html
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4740
Trust: 0.8
url:http://jvn.jp/cert/jvnvu660688
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4740
Trust: 0.8
url:http://www.scadaengine.com/software7.html
Trust: 0.3
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=41466
Trust: 0.1
url:http://secunia.com/advisories/41466/#comments
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/windows_insecure_library_loading/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#660688 // 
            
            
            
            CNVD: CNVD-2010-2060 // 
            
            
            
            BID: 43289 // 
            
            
            
            JVNDB: JVNDB-2011-001152 // 
            
            
            
            PACKETSTORM: 93978 // 
            
            
            
            CNNVD: CNNVD-201102-232 // 
            
            
            
            NVD: CVE-2010-4740

CREDITS
Jeremy Brown
Trust: 0.9
sources:
            
            
            BID: 43289 // 
            
            
            
            CNNVD: CNNVD-201102-232

SOURCES
db:IVDid:7d7a45c1-463f-11e9-bbb9-000c29342cb1
db:IVDid:8cb14b48-1fae-11e6-abef-000c29c66e3d
db:CERT/CCid:VU#660688
db:CNVDid:CNVD-2010-2060
db:BIDid:43289
db:JVNDBid:JVNDB-2011-001152
db:PACKETSTORMid:93978
db:CNNVDid:CNNVD-201102-232
db:NVDid:CVE-2010-4740

LAST UPDATE DATE
2025-04-11T23:04:23.321000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#660688date:2011-02-03T00:00:00
db:CNVDid:CNVD-2010-2060date:2010-09-19T00:00:00
db:BIDid:43289date:2011-02-16T06:29:00
db:JVNDBid:JVNDB-2011-001152date:2011-03-03T00:00:00
db:CNNVDid:CNNVD-201102-232date:2011-02-16T00:00:00
db:NVDid:CVE-2010-4740date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:IVDid:7d7a45c1-463f-11e9-bbb9-000c29342cb1date:2010-09-19T00:00:00
db:IVDid:8cb14b48-1fae-11e6-abef-000c29c66e3ddate:2010-09-19T00:00:00
db:CERT/CCid:VU#660688date:2011-02-03T00:00:00
db:CNVDid:CNVD-2010-2060date:2010-09-19T00:00:00
db:BIDid:43289date:2010-09-16T00:00:00
db:JVNDBid:JVNDB-2011-001152date:2011-03-03T00:00:00
db:PACKETSTORMid:93978date:2010-09-18T10:27:24
db:CNNVDid:CNNVD-201102-232date:2011-02-16T00:00:00
db:NVDid:CVE-2010-4740date:2011-02-16T03:00:03.633