ICS-CERT Publishes Alerts on Promised Luigi Vulnerability Reports

Today the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published three alerts for control system vulnerabilities identified by Luigi as he promised. As is usual in these Alerts ICS-CERT does not identify Luigi as the discoverer of these vulnerabilities. But, a quick check of his web site certainly shows where they were originally published. Unusual for Luigi, these have not yet been posted to Bugtraq.

Since these are just Alerts, and ICS-CERT has not yet really had a chance to verify these vulnerabilities or the effectiveness of the proof-of-concept (PoC) code, there is not much information available in these alerts. More information is available on the Luigi web site. Here is a quick summary of the information available from ICS-CERT with links to the alert and the Luigi disclosure.

• IRAI Automgen (ICS-CERT; Luigi) – Buffer Overflow – Possible Remote Code Execution;

• Atvise webMI (ICS-CERT; Luigi) – Multiple (4) vulnerabilities – Data leakage and DOS; and

• OLE-OPC systems (ICS-CERT; Luigi) – Malformed Packet – DOS

NOTE: OLE-OPC ICS-CERT link corrected 10-12-11 13:59 EDT. Thanks to Dan for detecting the bad link. PJ Coyle