ICS-CERT: Measuresoft ScadaPro DLL Hijack Vulnerability

Tuesday, May 29, 2012

Infosec Island Admin

7fef78c47060974e0b8392e305f0daf0

Independent researcher Carlos Mario Penagos Hollmann identified a remotely exploitable, uncontrolled search path element vulnerability, commonly referred to as a DLL hijack, in Measuresoft’s ScadaPro application.

Measuresoft has produced an upgrade to address this vulnerability. Mr. Hollmann has verified that the new version resolves the vulnerability.

The following Measuresoft products are affected:

• ScadaPro Server, prior to Version 4.0.0, and
• ScadaPro Client, prior to Version 4.0.0.

IMPACT

Successful exploitation of this vulnerability may lead to arbitrary code execution.
Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

BACKGROUND

ScadaPro is a supervisory control and data acquisition (SCADA) system used in the power generation, oil and gas, pharmaceuticals, and manufacturing sectors. According to Measuresoft, ScadaPro is sold in multiple countries by various third-party distributors, making total deployment difficult to quantify.

Measuresoft Development Ltd. is headquartered in Louth, Ireland, with an office in Missouri City, Texas.

VULNERABILITY OVERVIEW

UNCONTROLLED SEARCH PATH ELEMENT:  ScadaPro uses a fixed or controlled search path to find resources, which could allow an unauthorized user to easily locate and exploit one or more locations. An unauthorized user could place a malicious DLL in a directory where it could be loaded before the valid DLL. An attacker must have access to the host file system to exploit this vulnerability. If exploited, this vulnerability could allow execution of arbitrary code.

CVE-2012-1824 has been assigned to this vulnerability. A CVSS v2 base score of 6 has been assigned; the CVSS vector string is (AV:L/AC:H/Au:S/C:C/I:C/A:C).

EXPLOITABILITY:  This vulnerability can be remotely exploited.

EXISTENCE OF EXPLOIT:  No known public exploits specifically target this vulnerability.

DIFFICULTY:  An attacker with a moderate skill level could be able to exploit these vulnerabilities.

Measuresoft has produced an upgrade to address this vulnerability. Links to the upgrade can be found here:

• ScadaPro Server: http://www.measuresoft.net/download/versions.aspx?v=CB&d=Server, and

• ScadaPro Client: http://www.measuresoft.net/download/versions.aspx?v=CB&d=Client.
Microsoft has also released a Security Advisory (2269637)

The full ICS-CERT advisory can be found here:

Source:  http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-01.pdf

Possibly Related Articles:
7946
SCADA
Industrial Control Systems
SCADA Network Security Infrastructure Mitigation ICS-CERT vulnerability IS Controls DLL Hijack Measuresoft ScadaPro
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.