-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0020                  AUSCERT Advisory

                                   [Win]
      Multiple vulnerabilities in various OPC Server implementations
                               27 March 2007
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              DeviceXPlorer MELSEC OPC Server
                      DeviceXPlorer SYSMAC OPC Server
                      DeviceXPlorer FA-M3 OPC Server
                      DeviceXPlorer TOYOPUC OPC Server
                      DeviceXPlorer HIDIC OPC Server
                      DeviceXPlorer MODBUS OPC Server
                      NETxAutomation NETxEIB OPC Server versions prior to 
                        3.0.1300
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-1313 CVE-2007-1319
Member content until: Tuesday, April 24 2007

Original Bulletin:    http://www.kb.cert.org/vuls/id/296593
                      http://www.kb.cert.org/vuls/id/926551

OVERVIEW:
        
        Two sever implementations of the OPC (OLE for Process Control) 
        specification have been found to contain vulnerabilities. OPC is 
        often used in may Process Control and SCADA (Supervisory Control 
        And Data Acquisition) implementations.


IMPACT: 

        The Takebishi DeviceXPlorer OPC Server and NETxAutomation 
        NETxEIB OPC Server fail to properly validate server handles. 
        This may result in a remote attacker's inappropriate access to the 
        server memory, which may be further leveraged to execute arbitrary 
        code or causing a denial of service.


MITIGATION:

        According to advisories [1][2] patches are available for 
        DeviceXPlorer OPC Server and NETxEIB OPC Server.

        Limiting network connectivity to OPC Server may be a useful 
        mitigation strategy in the interim prior to applying the software 
        patches.


REFERENCES:

        [1] Multiple vulnerabilities in NETxEIB OPC server
            http://neutralbit.com/advisories/NB07-22.txt


        [2] The vulnerability of DeviceXPlorer OPC Server
            http://www.faweb.net/us/opc/1231207.html
 

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRgi5zih9+71yA2DNAQKEfQP+OgaR+Ro7tH/O/gnkwgK4gOFKXWsxznPB
Q25kEDUVND1SXkW4iwEn54w2VTvl55R5xRKowyA14hxp//9Lj6409JQi/CZlhZZA
a1wqLxfuJ6WuNXIcgfIbu7WmgzJgiSUo0x0m2xVYiNnE7DcaNNu39tzD7UqwfhMi
IUNqEMDEHdc=
=Mj3r
-----END PGP SIGNATURE-----