Rockwell Automation has produced software updates to address a buffer overflow vulnerability affecting a component of the RSLinx Classic solution.
RSLinx Classic is a comprehensive factory communication server used for Rockwell Automation networks and devices. The company says the solution is the most widely installed communication server in automation.
According to an advisory published by ICS-CERT, RSLinx Classic versions prior to 3.73.00 are plagued by a stack-based buffer overflow vulnerability (CVE-2014-9204) that can be exploited to crash the application or to inject malicious code.
In order to exploit the security bug, an attacker needs to trick a user into loading a specially crafted CVS file that triggers the buffer overflow into the vulnerable application. The attacker can cause the application to crash or he can execute arbitrary code with the same — or possibly even higher — privileges than the targeted user.
ICS-CERT has pointed out that the vulnerability cannot be exploited remotely and without user interaction.
The vulnerability exists in the OPC Data Access (DA) protocol test client OPCTest.exe. Rockwell Automation addressed the vulnerability by including a new version of the test client into version 3.73 of RSLinx Classic.
Rockwell Automation advises customers to update their RSLinx Classic installations. Additionally, the company advises organizations to take further precautions, such as not opening CVS files from untrusted sources, limiting access to RSLinx Classic to authorized personnel, not running software with administrator privileges, restricting network access to the software, the use of application whitelisting, maintaining physical and logical security for ICS, and security training for employees.
The vulnerability was identified by Argentina-based researcher Ivan Sanchez, who has been credited over the past period for finding security holes in several industrial control system products.
Last week, ICS-CERT revealed that the stack-based buffer overflow in OPCtest.exe also affects products developed by Opto 22, a California-based company that provides solutions for industrial automation, remote monitoring, and data acquisition.