Two New ICS-CERT Advisories

Today the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published two new control system advisories; one for Invensys Wonderware, and the other for 7-Technologies Data Server. Both advisories were previously published in the limited distribution on the US-CERT secure portal.

Invensys

The three buffer overflow vulnerabilities described in this Advisory were reported by Kuang-Chun Hung of the Security Research and Service Institute−Information and Communication Security Technology Center (ICST). They would allow a low skilled attacker to execute a denial of service attack and a more skilled attacker to execute arbitrary code on the system. The US-CERT/NIST vulnerability summary is available for these vulnerabilities (Note: The link does work).

Invensys has developed software updates for the affected Wonderware InBatch systems.

7-Technologies

The second advisory involved another buffer overflow vulnerability that was discovered in the 7-Technologies IGSS Data Server by UCQ from the Cyber Defense Institute, Inc. A moderately skilled attacker could use this vulnerability to execute a DOS attack on the system. A CVE number has been assigned to this vulnerability, but it is not yet live on the US-CERT/NIST site.

7T has developed a patch to address this vulnerability and it is currently available on the IGSS web site (NOTE: This link is to a .ZIP file).

Cyber Security Evaluation Tool

The ICS-CERT web page also contains a link to version 4.0.1 of the Cyber Security Evaluation Tool (CSET^TM). There is no indication when exactly that new version became available nor is there any explanation on the CSET web site of how the new version differs from version 4.0; though one would expect the differences to be relatively minor.