Researchers at Cisco Talos have reported finding a high severity code execution vulnerability in the LabVIEW system design software from National Instruments.
According to Talos, LabVIEW 2016 version 16.0 is affected by a heap-based buffer overflow vulnerability which can be triggered with a specially crafted VI file (a LabVIEW specific format) that causes a user-controlled value to be used as a loop terminator.
By getting a targeted user to open a malicious VI file, a remote attacker can execute arbitrary code. Cisco has published an advisory containing technical details about the flaw, which is tracked as CVE-2017-2775.
The security hole was reported to National Instruments on January 13 and it was disclosed on March 22, but it’s unclear if a patch is available. An update released recently by the vendor does address a memory corruption issue that fits the description.
SecurityWeek has reached out to both Cisco and National Instruments for clarifications and will update this article if they respond. Update: Cisco has confirmed that the vulnerability has been patched.
LabVIEW is often used for data acquisition, instrument control and industrial automation, and this vulnerability could allow a threat actor to compromise a device responsible for controlling a physical system.
Learn More at the 2017 Singapore ICS Cyber Security Conference
“Organizations using this and similar software to control physical systems need to bear in mind the possibility of attackers exploiting vulnerabilities in control software to gain access to physical systems,” Talos said in a blog post.
“Equally, organizations should remember that proprietary file formats do not protect against software vulnerabilities. Even in the absence of a published file format specification vulnerabilities triggered by malicious files may still be discovered,” it added.
Related: Non-Targeted Malware Hits 3,000 Industrial Sites a Year
Related: Exploring Risks of IT Network Breaches to Industrial Control Systems