Canada-based industrial connectivity solutions provider MatrikonOPC has released a software update to address a vulnerability affecting OPC Server for DNP3 (Distributed Network Protocol).
MatrikonOPC Server for DNP3 is a Windows application that facilitates connectivity to multiple DNP3 compliant devices, including remote terminal units, meters, and programmable logic controllers. The product is used by organizations in sectors such as chemical and energy, mainly in the United States, the United Kingdom and Canada.
According to an advisory published on Tuesday by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), the product is affected by an unhandled C++ exception that can be exploited remotely to cause a denial-of-service (DoS) loop in the MatrikonOPC Server for DNP3 Windows service. An attacker can cause the OPC server to exit and stop communicating until it’s manually restarted.
“An unhandled C++ exception occurs upon receiving a specifically formatted message. The DNP3 process within Windows service crashes, and the service cannot be stopped via services dialog. Restoration of service requires a system reboot,” reads the advisory.
The vulnerability was discovered by Chris Sistrunk of Mandiant and Adam Crain of Automatak, and it was reported to the vendor via ICS-CERT. The flaw, which affects OPC Server for DNP3 version 1.2.3 and earlier, has been assigned the CVE identifier CVE-2014-5426.
There are no known exploits for the vulnerability and MatrikonOPC says an attacker would require expert knowledge of the DNP3 protocol and an in-depth understanding of the vulnerability.
“CAUTION: Due to the wide variety of site-specific architectures & customization, it is the responsibility of each customer to assess the potential impact of this anomaly to their process & facilities,” the company noted in its own report.
MatrikonOPC has instructed customers to obtain the new version of the OPC Server for DNP3 by contacting the company’s support department.
As a workaround, the researchers who discovered the flaw suggest the use of an Intrusion Prevention System (IPS) or a firewall with DNP3-specific rule sets to prevent DNP3 traffic from traversing onto corporate networks.
ICS-CERT advises organizations to protect their control systems by minimizing network exposure, placing them behind firewalls and isolating them from the business network, and using virtual private networks (VPNs) for remote access.
On Tuesday, ICS-CERT also published an advisory for vulnerabilities affecting Siemens products that use the SIMANTIC WinCC supervisory control and data acquisition (SCADA) system. Siemens started releasing software updates for the impacted products last week.
Industrial control systems are increasingly targeted in cyberattacks. Last month, ICS-CERT issued a warning on a campaign in which a variant of the BlackEnergy malware has been used to compromise ICS environments.