GE Fanuc Proficy Information Portal 2.6 Authentication Vulnerability

2008-01-29 / 2008-01-30
Credit: Eyal Udassin
Risk: Low
Local: No
Remote: Yes
CWE: CWE-310


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Background ----------------- GE-Fanuc's Proficy Information Portal 2.6 is a web based reporting application for the SCADA environment. As such it will usually be installed in a buffer zone between the SCADA and the corporate network, which makes it a very sensitive application as it can access both networks. Description ---------------- The login process of Proficy involves sending the username in cleartext and the password in Base64 encoded format. This transmition can potentially be intercepted and decoded by an attacker with access to the data traffic. Impact ---------- An attacker can harvest user credentials by intercepting the traffic between the browser and the Proficy server. Affected Versions ------------------------- Proficy Information Portal 2.6 Previous versions may be vulnerable, as they were not tested. Workaround/Fix ----------------------- The vendor issued a KB article on how to resolve this vulnerability at the GE-Fanuc website, yet the proposed solution was not verified by C4. Additional Information ------------------------------- For additional information please contact us at info (at) c4-security (dot) com. [email concealed] Note that we will respond only to verified utility personnel and governmental agencies. The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0174 Credit --------- This vulnerability was discovered by Eyal Udassin of C4. Regards, Eyal Udassin - C4 (Formerly Swift Coders) 33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel eyal.udassin (at) c4-security (dot) com [email concealed] / www.c4-security.com <http://www.c4-security.com/> +972-547-684989


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top