ICS-CERT: Open Automation Software OPC Systems Vulnerability

Friday, January 13, 2012



This Advisory is a follow-up to “ICS-ALERT-11-285-01—Open Automation Software OPC Systems.NET vulnerability” that was posted on the ICS-CERT website on October 12, 2011.

Independent researcher Luigi Auriemma publicly reported a malformed packet vulnerability in Open Automation Software’s OPC Systems.NET along with proof-of-concept (PoC) exploit code. This public report was released without coordination with Open Automation Software, ICS-CERT, or any other coordinating entity known to ICS-CERT.

ICS-CERT has coordinated this vulnerability with Open Automation Software, and they have produced an update that resolves this vulnerability. Luigi Auriemma has tested the update and has confirmed that it resolves the vulnerability.


All versions of OPC Sytems.NET prior to Version 5.0 are affected.


A malformed packet could be sent remotely to cause a denial of service. Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their environment, architecture, and product implementation.


Open Automation Software is a US-based company that provides .NET products for supervisory control and data acquisition (SCADA) and human-machine interfaces (HMI) applications.

According to Open Automation Software, OPC Systems.NET is an HMI application that is deployed across several sectors including manufacturing, information technology, energy, water and wastewater, defense, and others. Open Automation Software estimates that these products are used throughout the world with primary use in the United States.


The vulnerability is exploitable by sending a malformed .NET Remote Procedural Call (RPC) packet to cause a denial of service through Port 58723/TCP. CVE-2011-4871 has been assigned to this vulnerability.


This vulnerability is remotely exploitable.


Public exploits are known to target this vulnerability.


Crafting a working exploit for this vulnerability requires moderate skill.


Open Automation Software has released OPC Systems.NET Version 5.0 that resolves the reported vulnerability by removing the vulnerable component. Customers with vulnerable versions of Open Automation Software OPC Sytems.NET should deploy the update, which is available at: http://www.opcsystems.com/downloads.htm.

View the full ICS-CERT advisory here:

Source:  http://www.us-cert.gov/control_systems/pdf/ICSA-12-012-01.pdf

Possibly Related Articles:
Denial of Service SCADA Application Security Vulnerabilities Exploits Headlines Advisory ICS ICS-CERT Luigi Auriemma PC Systems.NET
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.