Vulnerability Note VU#181737

IntelliCom NetBiter Config HICP hostname buffer overflow

Original Release date: 24 Mar 2010 | Last revised: 26 Mar 2010

Overview

The IntelliCom NetBiter Config HICP configuration utility has a buffer overflow vulnerability that can be triggered by a specially crafted hostname (hn) value. An attacker with network access could exploit this vulnerability to execute arbitrary code with the privileges of the user running NetBiter Config.

Description

IntelliCom NetBiter devices are based on HMS Anybus technology. The HMS HICP protocol (3250/udp) provides a way to configure network settings for NetBiter and possibly other Anybus-based devices. The NetBiter Config HICP configuration utility (NetbiterConfig.exe) has a buffer overflow vulnerability that can be triggered by a specially crafted hostname (hn) value. Further details are available in the original post by Rubén Santamarta.

Impact

An attacker with network access could exploit this vulnerability to execute arbitrary code with the privileges of the user running NetBiter Config.

Solution

Upgrade

This vulnerability is addressed in NetBiter Config version 1.3.1. Please see IntelliCom Security Bulletin ISFR-4404-0007.


Restrict access

Restrict access to SCADA, DCS, and other control system networks.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
IntelliCom Innovation ABAffected-19 Mar 2010
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This information was published by Rubén Santamarta.

This document was written by Art Manion.

Other Information

  • CVE IDs: CVE-2009-4462
  • Date Public: 12 Dec 2009
  • Date First Published: 24 Mar 2010
  • Date Last Updated: 26 Mar 2010
  • Severity Metric: 0.48
  • Document Revision: 19

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.