Alstom Patches Software Vulnerability

Wednesday, October 9, 2013 @ 01:10 PM gHale


Alstom created a patch that mitigates an improper input validation in its e-terracontrol software vulnerability, according to a report on ICS-CERT.

Adam Crain of Automatak and independent researcher Chris Sistrunk, who found the vulnerability, tested the patch to validate that it resolves the remotely exploitable vulnerability.

RELATED STORIES
Additional Patches for Rockwell
Philips Fixes Buffer Overflow
Bug in Siemens SCALANCE X-200
Emerson Patches RTU Holes

The following Alstom product suffers from the issue: e-terracontrol, Version 3.5, 3.6, and 3.7.

Successful exploitation of this vulnerability could allow an attacker to affect the availability of the Alstom e-terracontrol software.

Alstom is a France-based company that maintains offices worldwide. The affected product, Alstom e-terracontrol software, applies mainly to SCADA systems to monitor and control electrical energy systems. According to Alstom, e-terracontrol software is mainly in the electric energy sector. Alstom estimates these products are primarily in the U.S. and Europe with a small percentage in Asia.

The Alstom e-terracontrol software does not validate or incorrectly validates input. An attacker could cause the software to go into an infinite loop, causing the process to crash. To clear the problem, a user would have to manually restart the system.

CVE-2013-2787 is the number assigned to this vulnerability, which has a CVSS v2 base score of 7.1.

No known public exploits specifically target this vulnerability, but an attacker with a moderate skill level would be able to exploit this vulnerability.

Alstom produced a patch that is available for download from the Alstom Grid Customer Wise portal.



Leave a Reply

You must be logged in to post a comment.