SCADA: ABB MicroSCADA Wserver Component Arbitrary Command Execution

This signature detects attempts to exploit a known vulnerability against the Wserver component of ABB MicroSCADA. It is because user controlled data is passed as command line arguments to the CreateProcessA function enabling arbitrary command execution without access control. A remote unauthenticated attacker can exploit this vulnerability by sending requests with the EXECUTE opcode to the vulnerable service. Successful exploitation could lead to arbitrary command execution in the context of the Wserver process.

References

BugTraq: 63901

URL: http://www05.abb.com/global/scot/scot229.nsf/veritydisplay/41ccfa8ccd0431e6c1257c1200395574/$file/ABB_SoftwareVulnerabilityHandlingAdvisory_ABB-VU-PSAC-1MRS235805.pdf http://www05.abb.com/global/scot/scot229.nsf/veritydisplay/41ccfa8ccd0431e6c1257c1200395574/$file/abb_softwarevulnerabilityhandlingadvisory_abb-vu-psac-1mrs235805.pdf http://www.zerodayinitiative.com/advisories/zdi-13-270/

Short Name

SCADA:ABB-WSERVER-CMD-EXEC

Severity

Major

Recommended

False

Recommended Action

Drop

SCADA: ABB MicroSCADA Wserver Component Arbitrary Command Execution

References

Found a potential security threat?