-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2009.0010-- AUSCERT ALERT
                             [Win][UNIX/Linux]
        AREVA e-terrahabitat SCADA systems vulnerabilities Overview
                              9 February 2009

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              e-terrahabitat MLF application
                      e-terrahabitat WebFGServer application
                      e-terrahabitat NETIO application
Publisher:            US-CERT
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Administrator Compromise
                      Execute Arbitrary Code/Commands
                      Increased Privileges
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2009-0210 CVE-2009-0211 CVE-2009-0212
                      CVE-2009-0213 CVE-2009-0214

Original Bulletin:    http://www.kb.cert.org/vuls/id/337569

- --------------------------BEGIN INCLUDED TEXT--------------------

Vulnerability Note VU#337569

AREVA e-terrahabitat SCADA systems vulnerabilities

Overview

   AREVA e-terrahabitat contains multiple vulnerabilities.

I. Description

   AREVA e-terrahabitat is a core component of the Energy Management system 
   that provides real-time data and process management services. 
   e-terrahabitat contains vulnerabilities, including a buffer overflow. For 
   more information on these issues AREVA customers should review the 
   following issues in AREVA T&D Security Bulletin - ATD-08-002:

    * PD28578 Buffer Overflow Vulnerability in e-terrahabitat MLF 
        application
    * PD32018 Denial of Service Vulnerability in e-terrahabitat WebFGServer 
        application
    * PD32020 Denial of Service Vulnerability in e-terrahabitat WebFGServer 
        application
    * PD32021 Denial of Service Vulnerability in e-terrahabitat NETIO 
        application
    * PD32022 Privilege Escalation in e-terrahabitat WebFGServer 
        application


   Note that these issues affect versions 5.7 and earlier.

II. Impact

   An unauthenticated attacker may be able to gain access with the 
   privileges of the e-terrahabitat account or an administrator account and 
   execute arbitrary commands, or cause a vulnerable system to crash.

III. Solution

   Apply Patch

   Users of e-terrahabitat version 5.5, 5.6, and 5.7 should apply the 
   e-terrahabitat_560_P20081030_SEC patch immediately.

   Upgrade

   Users of affected software with versions 5.4 and earlier are encouraged 
   to upgrade to 5.6 or above.

   Intrusion Detection

   According to AREVA T&D Security Bulletin - ATD-08-002:

   Strong network perimeter access controls can reduce the potential avenues 
   of attack. In cooperation with AREVA, the US Department of Homeland (DHS) 
   Security Control Systems Security Program (CSSP) developed Snort based 
   network intrusion detection signatures that are available for AREVA 
   customer use only to detect attempts to exploit vulnerabilities within the 
   WebFGServer. Due to unique system configuration dependencies, the 
   signatures must be tuned to your specific environment. Please contact 
   AREVA to obtain these signatures. DHS and AREVA cannot provide support for 
   the signatures at this time.

   Restrict Access

   Limit network access to hosts that require connections to the portal. Do 
   not allow access to the portal from untrusted networks such as the 
   internet.

Systems Affected

   Vendor	        Status	       Date Notified	Date Updated
   AREVA T&D	        Vulnerable		        2009-02-03

References

   http://www.areva.com
   http://www.scada-security.com/vulnerabilities/areva1.html

Credit

   This vulnerability was reported in AREVA T&D Security Bulletin - 
   ATD-08-002. AREVA credits Eyal Udassin and Jonathan Afek of C4, Idaho 
   National Labs, and Department of Hmeland Security Control Systems 
   Security Program (DHS CSSP) with discovering and verifying these issues.

   This document was written by Chris Taschner.

Other Information

   Date Public:	                2009-02-05
   Date First Published:	2009-02-05
   Date Last Updated:	        2009-02-06
   CERT Advisory:	 
   CVE-ID(s):	                CVE-2009-0210 CVE-2009-0211 CVE-2009-0212 
                                CVE-2009-0213 CVE-2009-0214
   NVD-ID(s):	                CVE-2009-0210 CVE-2009-0211 CVE-2009-0212 
                                CVE-2009-0213 CVE-2009-0214
   US-CERT Technical Alerts:	 
   Metric:	                0.95
   Document Revision:	        23

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFJkMKaNVH5XJJInbgRAg53AJ9lyyfV/SnmOyRp0WdEiItpmQ5KbACdHdCI
syCwmCygMx8doUCPfxYfyQM=
=s/1k
-----END PGP SIGNATURE-----