Thursday, September 25, 2008

C4 Security Advisory - ABB PCU400 4.4-4.6 Remote Buffer Overflow

Background
-----------------
Vendor product information:
PCU400 is the modern product when implementing an effective data acquisition
network in SCADA-based systems

PCU400, Process Communication Unit 400 forms the communication interface to
the network of remote terminal units (RTUs) together with the RCS
Application Software located in the application server of a Network Manager
SCADA system.
The PCU400 can be used as a SCADA front-end, communication gateway for
Substation Automation systems or as a standalone protocol converter.
Two parts define the Data Acquisition system:
* RCS Application, a software package running in the Application Server
* PCU400, a front-end converter that implements the protocols and
connects the physical lines

PCU 400 can be used in a variety of configurations to cater for different
network topologies and different levels of fault tolerance in the system.
The alternatives include single or redundant PCU 400 units.


Description
----------------
A buffer overflow exists in the component that handles IEC60870-5-101 and
IEC60870-5-104 communication protocols.
The vulnerability was exploited by C4 to verify it can be used for arbitrary
code execution by an unauthorized attacker.
The description of the vulnerability is intentionally limited as this
software controls critical national infrastructure.


Impact
----------
An attacker can compromise the server which runs PCU400, which acts as the
FEP server of the ABB SCADA system.
This vulnerability is another method to carry out the "field to control
center" attack vector mentioned in C4's S4 2008 paper "Control System Attack
Vectors and Examples: Field Site and Corporate Network", which will allow
the attacker to control other RTUs connected to that FEP.

In addition, an attacker can use his control over the FEP server to insert a
generic electric grid malware as specified in our SysScan08 presentation, in
order to cause harm to the grid.

Both documents are available at http://www.c4-security.com/index-5.html .


Affected Versions
-------------------------
PCU400 4.4
PCU400 4.5
PCU400 4.6
Other versions may be vulnerable, as they were not tested.


Workaround/Fix
-----------------------
The vendor issued a hotfix to resolve this vulnerability.


Additional Information
-------------------------------
For additional information please contact us at info_at_c4-security.com.
Note that we will respond only to verified utility personnel and
governmental agencies.
The CVE identifier assigned to this vulnerability by CERT is CVE-2008-2474


Credit
--------
This vulnerability was discovered and exploited by Idan Ofrat of C4.

Regards,


Eyal Udassin - C4

33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel

No comments: