U.S. Flag Official website of the Department of Homeland Security
U.S. Department of Homeland Security Seal. ICS-CERT. Industrial Control Systems Cyber Emergency Response Team.
TLP:WHITE

Advisory (ICSA-11-277-01)

Schneider Electric UnitelWay Buffer Overflow

Original release date: October 20, 2011 | Last revised: May 07, 2013

Legal Notice

All information products included in http://ics-cert.us-cert.gov are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/.



Overview

ICS-CERT originally released Advisory ICSA-11-277-01P on the US-CERT secure Portal on October 04, 2011. This web page release was delayed to allow users sufficient time to download and install the update.

Researcher Kuang-Chun Hung of Security Research and Service Institute—Information and Communication Security Technology Center (ICST) has identified a buffer overflow vulnerability in UnitelWay Windows Device Driver. This device driver is deployed as part of several different Schneider Electric products.

ICS-CERT has coordinated this vulnerability report with Schneider Electric. The vendor has produced a fix that resolves this vulnerability. ICST has successfully tested and validated that this fix fully resolves this vulnerability.

Affected Products

The following software packages are affected:

Product

Version

Platform

Unity ProVersion 6 and priorWindows XP
OPC Factory ServerVersion 3.34Windows XP
Vijeo CitectVersion 7.20 and priorWindows XP
Telemecanique Driver PackVersion 2.6 and priorWindows XP
Monitor ProVersion 7.6 and priorWindows XP
PL7 ProVersion 4.5 and priorWindows XP

These six products are known to have the vulnerable UnitelWay Windows Device Driver and are elements of Schneider Electric SoCollaborative software components. These components are part of Schneider Electric process automation architecture known as PlantStruxure.

Impact

Exploitation of this vulnerability will allow an attacker to run arbitrary code on the targeted system. Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their environment, architecture, and product implementation.

Background

Schneider Electric is a manufacturer and integrator of energy management equipment and software. Schneider Electric systems are found in the energy, manufacturing, building automation, and information technology. Schneider Electric reports operations in over 100 countries worldwide.

Vulnerability Characterization

Vulnerability Overview

An oversized input string to a parameter in this system using the UnitelWay Windows Device Driver causes a buffer overflow that allows arbitrary code execution.

CVE-2011-3330 has been assigned to this vulnerability.

Vulnerability Details

Exploitability

This vulnerability is not remotely exploitable.

Existence of Exploit

No known exploits specifically target this vulnerability.

Difficulty

An attacker with a low skill level can create a denial of service whereas it would require a more skilled attacker to execute arbitrary code.

Mitigation

Schneider Electric has created a fix that modifies one of the libraries of the UnitelWay Windows Device Driver. Schneider Electric has also issued a customer notification describing the vulnerability.1 Schneider  Electric recommends that since the functionality of the existing version is not affected by the installation of the fix, all customers should install the fix, which is available at the following address: www.scada.schneider-electric.com/download/security/HFPEP0047398R.zip

Schneider Electric recommends that customers requiring additional assistance contact their global support center or a local customer service center. Contact information is available at the following web addresses.

Vijeo Citect customers should contact Schneider Electric’s SCADA and MES Software Support Center.

Customers of all other affected Schneider Electric products should contact their local support center.

In addition to applying the fix developed by Schneider Electric, ICS-CERT encourages asset owners to take additional defensive measures against this and other cybersecurity threats by:

  • Minimizing network exposure for all control system devices. Critical devices should not directly face the Internet.
  • Locating control system networks and remote devices behind firewalls, and isolate them from the business network.
  • When remote access is required, using secure methods, such as Virtual Private Networks (VPNs), recognizing that VPN is only as secure as the connected devices.

ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.

The Control Systems Security Program (CSSP) also provides a recommended practices section for control systems on the CSSP web page. Several recommended practices are available for reading or download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.


Contact Information

For any questions related to this report, please contact the NCCIC at:

Email: NCCICCUSTOMERSERVICE@hq.dhs.gov
Toll Free: 1-888-282-0870

For industrial control systems cybersecurity information:  http://ics-cert.us-cert.gov 
or incident reporting:  https://ics-cert.us-cert.gov/Report-Incident?

The NCCIC continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top