Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT Security Bulletin
ASB-2013.0018
A vulnerability has been identified in IntegraXor SCADA Server
11 February 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IntegraXor SCADA Server
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2012-4700
Member content until: Wednesday, March 13 2013
OVERVIEW
A vulnerability has been identified in IntegraXor SCADA Server prior
to version 4.0 build 4250.0. [1]
IMPACT
The vendor has provided the following description regarding this
vulnerability:
"Security researcher Andrew Brooks have reported a vulnerability that
may occur when a specially crafted HTML document is opened with
ActiveX enabled browser, typically Microsoft I.E.. Successful
exploitation may crash the said browser. This attack has no impact on
IntegraXor SCADA server itself." [1]
ICS-CERT have also provided the following impact:
"The vulnerability originates from buffer overflows in the PE3DO32A.ocx
service component and can occur in multiple locations of the module. An
attacker would need to create a specially crafted Web page or file with
an ActiveX component for the client to open. This could allow an
attacker to cause a crash or to execute arbitrary code." [2]
MITIGATION
The vendor recommends updating to the latest version of the IntegraXor
SCADA Server application.
"IGX developers have taken proactive step to patch the reported
vulnerability immediately on the next day, and has been included in
latest Release which can be obtained at this link:
http://www.integraxor.com/download/beta.msi?4.00.4283.
All previous release before build 4283 will have this vulnerability
impact. Please download and use this build or any future release to fix
this ActiveX enabled browser vulnerability." [1]
REFERENCES
[1] Security Issue for ActiveX enabled browser Vulnerability Note
http://www.integraxor.com/blog/security-issue-for-activex-enabled-browser-vulnerability-note
[2] PE3DO32A.OCX BUFFER OVERFLOW
http://ics-cert.us-cert.gov/pdf/ICSA-13-036-02.pdf
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBURh49u4yVqjM2NGpAQJXSw/+OiV5/+w9F1iLBlJ+bumUbIl/+GoG6s6Q
Xk5+QPd8m++8yX0FljJR7IWy0UpGCo9ISqwnCoXksRToaZii7JfF98uaQKTmQAPW
AOmUNEygSpd1RnnvPqWwwSKFaVT9C4kuC8zdoxu1QAStQpbozW/F3D8/kyIPR5Hq
sPb69oc8IFkMHpOmEXGW22/Uxyd9XeqVgbgoLE0kGEyBYaIQbGga4+Yv/GmtQUOs
0OsqC0mvHpD11oDKMWXNxKZMkuPi7L0TozXdGi3J21oPXu563L4hd1wAxDOsLFaE
Nyn3EHD8KJ6qqsfnuruxvrAxUqncEkWIZJ4i+25Nw+06NCp4XUX2ikpQ8z1oDDtn
kCWD92m14LxHhPi66EhwEzHZvV/eqwLsAkhWyq7qmSnjdSZEGOYmPDCQRoGfbxg9
Yu3DopSPuXRlTHCovYZ+VFU03vO6qbJKdarPDEp+Pd7H/pF/QRWw1mmdJRER15na
jBBMzdOvP3LSGud4IVo9PF/NSdOZBrmuJA4IIYMDhFJwt78ERoDq8twQS9G0TrcE
rWJsLnZTbrhnKUvUz5fdV2vA24RX2c1PaBzfF0whRoHzAF9vKuxLGUQffVoxIBVU
TOc15auIqO3bE1rijDBIITuKxDGY178VTM4EmjGn2pvN+UPPs9P9jY1n0QqONhqD
ioKPK6VhrSY=
=kjSC
-----END PGP SIGNATURE-----