KingSCADA Insecure Password Encryption Information Disclosure Vulnerability

Bugtraq ID:	51582
Class:	Input Validation Error
CVE:	CVE-2012-1977
Remote:	Yes
Local:	No
Published:	Jan 20 2012 12:00AM
Updated:	May 08 2012 10:10PM
Credit:	Alexandr Polyakov and Alexey Sintsov
Vulnerable:	Wellintech KingSCADA 3.0
Not Vulnerable:

KingSCADA Insecure Password Encryption Information Disclosure Vulnerability

KingSCADA is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain the password of the affected device.

KingSCADA 3.0 is vulnerable; other versions may also be affected.

KingSCADA Insecure Password Encryption Information Disclosure Vulnerability

An attacker can exploit this issue with readily available tools.

KingSCADA Insecure Password Encryption Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

KingSCADA Insecure Password Encryption Information Disclosure Vulnerability

References:

• KingSCADA Homepage (Wellintech)
  
• ICS-ALERT-12-020-06�??WELLINGTECH KINGSCADA INSECURE PASSWORD ENCRYPTION VULNERABI (ICS-CERT)
  
• ICSA-12-129-01�??WELLINTECH KINGSCADA INSECURE PASSWORD ENCRYPTION VULNERABILITY (US-CERT)