GE Fanuc iFIX Insecure Authentication Multiple Unauthorized Access Vulnerabilities

Bugtraq ID:	33739
Class:	Access Validation Error
CVE:	CVE-2009-0216
Remote:	Yes
Local:	Yes
Published:	Feb 11 2009 12:00AM
Updated:	Feb 12 2009 12:18AM
Credit:	Rayford Vaughn and Robert Wesley McGrew at Mississippi State University.
Vulnerable:	GE Fanuc iFIX PDE GE Fanuc iFIX 5.0 GE Fanuc iFIX 4.5 GE Fanuc iFIX 4.0 GE Fanuc iFIX 3.5 GE Fanuc iFIX 3.0 GE Fanuc iFIX 2.6 GE Fanuc iFIX 2.5 GE Fanuc iFIX 2.21 GE Fanuc iFIX 2.2 GE Fanuc iFIX 2.0 GE Fanuc iFIX 0
Not Vulnerable:

GE Fanuc iFIX Insecure Authentication Multiple Unauthorized Access Vulnerabilities

GE Fanuc iFIX is prone to multiple vulnerabilities that could let remote attackers obtain authentication credentials that allow access to vulnerable versions of the application.

GE Fanuc iFIX 5.0 are earlier are vulnerable.

GE Fanuc iFIX Insecure Authentication Multiple Unauthorized Access Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GE Fanuc iFIX Insecure Authentication Multiple Unauthorized Access Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GE Fanuc iFIX Insecure Authentication Multiple Unauthorized Access Vulnerabilities

References:

• Vendor Homepage (GE Fanuc)
  
• Security Issue: CERT Reported Vulnerabilities in iFIX Security (GE Fanuc)
  
• Vulnerability Note VU#310355 GE Fanuc Proficy HMI/SCADA iFIX uses insecure authe (US-CERT)