Background ----------------- Vendor product information: CIMPLICITY is a powerful and technically advanced HMI/SCADA product. With its open system design approach, true client/server architecture, and the latest web technologies, CIMPLICITY allows you to realize the benefits of digitization for the collection, monitoring, supervisory control and sharing of critical process and production data throughout your operations CIMPLICITY has been used in all industries -- from process to discrete, to system monitoring. It is extremely well suited for discrete applications, and handles very large amounts of digital signals and alarm bursts. Its advanced Client/Sever architecture makes it easy to start small and expand your system. Description ---------------- A heap overflow exists in a mandatory component in Cimplicity, which can be triggered remotely without authentication. The vulnerability was exploited by C4 to verify it can be used for arbitrary code execution by an unauthorized attacker. The description of the vulnerability is intentionally limited as this software controls critical national infrastructure. Impact ---------- An attacker can compromise the Cimplicity 6.1 control server, and each of the operator workstations. Affected Versions ------------------------- Cimplicity HMI 6.1 Cimplicity HMI 6.1 SP5 Cimplicity HMI 6.1 SP6 Previous versions may be vulnerable, as they were not tested. Workaround/Fix ----------------------- The vendor issued a hotfix to resolve this vulnerability Additional Information ------------------------------- For additional information please contact us at info (at) c4-security (dot) com. [email concealed] Note that we will respond only to verified utility personnel and governmental agencies. The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0176 Credit -------- This vulnerability was discovered and exploited by Gilad Bakas and Eyal Udassin of C4. Regards, Eyal Udassin - C4 (Formerly Swift Coders) 33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel eyal.udassin (at) c4-security (dot) com [email concealed] / www.c4-security.com <http://www.c4-security.com/> +972-547-684989