Multiple Holes with xArrow

Tuesday, March 6, 2012 @ 02:03 PM gHale


There is a public report detailing multiple vulnerabilities with proof-of-concept (PoC) exploit code affecting xArrow, a supervisory control and data acquisition/human-machine interface (SCADA/HMI) product.

These vulnerabilities, released by independent security researcher Luigi Auriemma without coordination with either the vendor, ICS-CERT, or any other coordination entity, are remotely exploitable.

RELATED STORIES
ABB Patches Robot Software
Advantech’s New Version of WebAccess
DLL Hijacking Hole with 7T
Threat Alert Reaches New High

ICS-CERT is attempting to coordinate the report with the vendor in order to confirm the vulnerabilities and identify mitigations. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations.

The report included vulnerability details and PoC exploit code for the following vulnerabilities:

The vulnerabilities include a decompression NULL pointer; heap corruption; invalid read access, and memory corruption. All vulnerabilities are remotely exploitable and can cause a denial of service (DoS) or in the case of the heap corruption, additionally, a possible arbitrary code execution.



Leave a Reply

You must be logged in to post a comment.