Control Microsystems ClearSCADA Authentication Security Bypass Vulnerability

Bugtraq ID:	49349
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 29 2011 12:00AM
Updated:	Aug 29 2011 12:00AM
Credit:	Jeremy Brown
Vulnerable:	Control Microsystems ClearSCADA 2010 R1.0 Control Microsystems ClearSCADA 2009 0 Control Microsystems ClearSCADA 2007 0 Control Microsystems ClearSCADA 2005 0
Not Vulnerable:	Control Microsystems ClearSCADA 2010 R1.4

Control Microsystems ClearSCADA Authentication Security Bypass Vulnerability

Control Microsystems ClearSCADA is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass authentication to obtain sensitive information or perform unauthorized actions; this may aid in launching further attacks.

Versions prior to ClearSCADA 2010 R1.1 are vulnerable.

Control Microsystems ClearSCADA Authentication Security Bypass Vulnerability

Currently we are not aware of any working exploits for the buffer-overflow issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Control Microsystems ClearSCADA Authentication Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

Control Microsystems ClearSCADA Authentication Security Bypass Vulnerability

References:

• ClearSCADA Homepage (Control Microsystem)
  
• ICSA-11-173-01�??CLEARSCADA REMOTE AUTHENTICATION BYPASS (CERT)