Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Security Infrastructure

DoS Vulnerability Found in MatrikonOPC Server for DNP3

Canada-based industrial connectivity solutions provider MatrikonOPC has released a software update to address a vulnerability affecting OPC Server for DNP3 (Distributed Network Protocol).

Canada-based industrial connectivity solutions provider MatrikonOPC has released a software update to address a vulnerability affecting OPC Server for DNP3 (Distributed Network Protocol).

MatrikonOPC Server for DNP3 is a Windows application that facilitates connectivity to multiple DNP3 compliant devices, including remote terminal units, meters, and programmable logic controllers. The product is used by organizations in sectors such as chemical and energy, mainly in the United States, the United Kingdom and Canada.

According to an advisory published on Tuesday by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), the product is affected by an unhandled C++ exception that can be exploited remotely to cause a denial-of-service (DoS) loop in the MatrikonOPC Server for DNP3 Windows service. An attacker can cause the OPC server to exit and stop communicating until it’s manually restarted.

“An unhandled C++ exception occurs upon receiving a specifically formatted message. The DNP3 process within Windows service crashes, and the service cannot be stopped via services dialog. Restoration of service requires a system reboot,” reads the advisory.

The vulnerability was discovered by Chris Sistrunk of Mandiant and Adam Crain of Automatak, and it was reported to the vendor via ICS-CERT. The flaw, which affects OPC Server for DNP3 version 1.2.3 and earlier, has been assigned the CVE identifier CVE-2014-5426.

There are no known exploits for the vulnerability and MatrikonOPC says an attacker would require expert knowledge of the DNP3 protocol and an in-depth understanding of the vulnerability.

“CAUTION: Due to the wide variety of site-specific architectures & customization, it is the responsibility of each customer to assess the potential impact of this anomaly to their process & facilities,” the company noted in its own report.

MatrikonOPC has instructed customers to obtain the new version of the OPC Server for DNP3 by contacting the company’s support department.

Advertisement. Scroll to continue reading.

As a workaround, the researchers who discovered the flaw suggest the use of an Intrusion Prevention System (IPS) or a firewall with DNP3-specific rule sets to prevent DNP3 traffic from traversing onto corporate networks.

ICS-CERT advises organizations to protect their control systems by minimizing network exposure, placing them behind firewalls and isolating them from the business network, and using virtual private networks (VPNs) for remote access.

On Tuesday, ICS-CERT also published an advisory for vulnerabilities affecting Siemens products that use the SIMANTIC WinCC supervisory control and data acquisition (SCADA) system. Siemens started releasing software updates for the impacted products last week.

 Industrial control systems are increasingly targeted in cyberattacks. Last month, ICS-CERT issued a warning on a campaign in which a variant of the BlackEnergy malware has been used to compromise ICS environments.

 

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Security Infrastructure

Security vendor consolidation is picking up steam with good reason. Everyone wants to improve security efficiency and effectiveness while paying for less.

Management & Strategy

Hundreds of companies are showcasing their products and services this week at the 2023 edition of the RSA Conference in San Francisco.

Cloud Security

The term ‘zero trust’ is now used so much and so widely that it has almost lost its meaning.

Security Infrastructure

Instead of deploying new point products, CISOs should consider sourcing technologies from vendors that develop products designed to work together as part of a...

Security Infrastructure

Comcast jumps into the enterprise cybersecurity business, betting that its internal security tools and inventions can find traction in an expanding marketplace.

Audits

The PCI Security Standards Council (SSC), the organization that oversees the Payment Card Industry Data Security Standard (PCI DSS), this week announced the release...

Security Infrastructure

XDR's fully loaded value to threat detection, investigation and response will only be realized when it is viewed as an architecture