Siemens SIMATIC WinCC Flexible Tag Simulator Remote Memory Corruption Vulnerability

Bugtraq ID:	49405
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 01 2011 12:00AM
Updated:	Sep 01 2011 12:00AM
Credit:	Billy Rios and Terry McCorkle
Vulnerable:	Siemens SIMATIC WinCC Flexible 2008 SP2 Siemens SIMATIC WinCC Flexible 2008 SP1 Siemens SIMATIC WinCC Flexible 2008 Siemens SIMATIC WinCC Flexible 2007 Siemens SIMATIC WinCC Flexible 2005 SP1 Siemens SIMATIC WinCC Flexible 2005 Siemens SIMATIC WinCC Flexible 2004 Siemens ProTool 6.0 SP3
Not Vulnerable:

Siemens SIMATIC WinCC Flexible Tag Simulator Remote Memory Corruption Vulnerability

Siemens SIMATIC WinCC Flexible is prone to a remote memory-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

The following versions are affected:

The following products are affected:

ProTool 6.0 SP3
WinCC flexible 2004
WinCC flexible 2005
WinCC flexible 2005 SP1
WinCC flexible 2007
WinCC flexible 2008
WinCC flexible 2008 SP1
WinCC flexible 2008 SP2

Siemens SIMATIC WinCC Flexible Tag Simulator Remote Memory Corruption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Siemens SIMATIC WinCC Flexible Tag Simulator Remote Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.

Siemens SIMATIC WinCC Flexible Tag Simulator Remote Memory Corruption Vulnerability

References:

• ICSA-11-175-02�??SIEMENS SIMATIC WINCC EXPLOITABLE CRASHES (US-CERT)
  
• Update für WinCC flexible Variablen Simulator (Siemens)