Today the DHS ICS-CERT published a control system
advisory for an improper input validation vulnerability in the SUBNET Solutions
Inc. SubSTATION Server software application. The vulnerability was reported by
Adam Crane and Chris Sistrunk in yet another coordinated disclosure.
ICS-CERT reports that a moderately skilled attacker could
remotely exploit the vulnerability to execute a denial of service attack.
SUBNET Solutions has produced an upgraded version of the software that is
available by contacting the company. ICS-CERT reports that SUBNET has
self-certified the efficacy of their revision.
BTW: There are still 15 ‘pending’ vulnerability reports on
the Project Robus web site; the
number does not seem to be increasing. As I understand it Adam and Chris have
taken a brief sabbatical from identifying new vulnerabilities to help re-write
portions of the DNP protocol to help eliminate these problems. Hopefully when
that is done they will select a new target for their interests.
Posts
No comments:
Post a Comment