Critical vulnerability in industrial control software
The ICS-CERT (Industrial Control Systems Cyber Emergency Response Team), an agency of the US Department of Homeland Security, has warned
of security vulnerabilities in globally distributed control software for industrial plants. Sunway ForceControl and pNetPower SCADA/HMI applications from the Chinese manufacturer Sunway (Chinese language) are affected, and are in use worldwide, in various industries.
Both products have server components which could be remotely compromised by using either HTTP requests (ForceControl) or UDP packets (pNetPower) to induce a heap-based buffer overflow. ICS-CERT says successful exploitation results in denial of service and possible execution of the arbitrary code. There are no known exploits of the vulnerabilities in circulation and Sunway has developed patches for ForceControl (Chinese language) and pNetPower (Chinese language).
The vulnerabilities were discovered by Dillon Beresford of NSS Labs who recently found weaknesses in Siemens control software. Beresford had been due to discuss those vulnerabilities at May's TakeDown Conference, but cancelled when Siemens found their proposed fixes and workarounds for the problems were ineffective.
(djwm)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
