CitectSCADA and Mitsubishi MX4 SCADA Batch Server Module Remote Buffer Overflow Vulnerability

Bugtraq ID:	50604
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 08 2011 12:00AM
Updated:	Mar 19 2015 09:43AM
Credit:	Kuang-Chun Hung
Vulnerable:	Schneider Electric CitectSCADA 7.10 Mitsubishi Electric MX4 SCADA 7.10
Not Vulnerable:

CitectSCADA and Mitsubishi MX4 SCADA Batch Server Module Remote Buffer Overflow Vulnerability

CitectSCADA and Mitsubishi MX4 SCADA are prone to a buffer-overflow vulnerability that affects the Batch server module.

An attacker could exploit this vulnerability to cause arbitrary code to run within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

The following versions are vulnerable:

CitectSCADA 7.10 and prior
Mitsubishi MX4 SCADA 7.10 and prior

CitectSCADA and Mitsubishi MX4 SCADA Batch Server Module Remote Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CitectSCADA and Mitsubishi MX4 SCADA Batch Server Module Remote Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

CitectSCADA and Mitsubishi MX4 SCADA Batch Server Module Remote Buffer Overflow Vulnerability

References:

• CitectSCADA Homepage (Schneider Electric)
  
• MX4 SCADA Homepage (Mitsubishi)
  
• ICSA-11-279-02�??CITECTSCADA AND MITSUBISHI MX4 SCADA BATCH SERVER BUFFER OVERFL (Kuang-Chun Hung)