RealFlex RealWin demo version contains a vulnerability in the way "FC_INFOTAG/SET_CONTROL" packets are processed.
RealFlex RealWin is SCADA server software that includes a Human Machine Interface (HMI) componant and runs on Microsoft Windows 2000 or XP. The demo version of RealWin contains a stack overflow in the way malicious "FC_INFOTAG/SET_CONTROL" packets are processed. According to Reversemode:
The bug is a classic stack overflow while processing a specially crafted FC_INFOTAG/SET_CONTROL packet. RealWin server accepts connections from FlewWin clients which use a propietary protocol. We can exploit this flaw from remote without having valid credentials.
This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service.
It appears that RealFlex (including RealWin and other products) was spun off from from DATAC (also known as: DCIL, DATAC Control International, Ltd., DATACONLINE) and that DATAC remains a licensed distributor of RealWin and other RealFlex products.
|Temporal||0||E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)|
|Environmental||0||CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)|
This issue was reported by Ruben Santamarta of Reversemode.
This document was written by Chris Taschner.
|Date First Published:||2008-12-02|
|Date Last Updated:||2009-01-13 15:57 UTC|