There is a remotely exploitable buffer overflow in a handful of software products from Schneider Electric that could allow an attacker to execute arbitrary code on vulnerable machines.
The vulnerability lies in a DLL that’s installed with a Device Type Manager that is part of several Schneider products, including the Unity Pro development software, the SoMachine software environment and the SoMove software for motor control devices. Schneider has released a patch for the vulnerability, which removes the vulnerable DLL.
“A DLL in a DTM development kit which is installed during DTM set up could be vulnerable to a buffer overflow that may allow an attacker to remotely execute code,” an advisory from ICS-CERT says.
The affected software is deployed in a variety of industries globally. The vulnerability was reported through the Zero Day Initiative at HP.
“NCCIC/ICS-CERT received a report from Ariele Caltabiano (kimiya) with HP’s Zero Day Initiative (ZDI) concerning a buffer overflow vulnerability in Schneider Electric’s SoMove Lite software package. While addressing this vulnerability, Schneider Electric identified multiple vulnerable Schneider Electric products. Schneider Electric has produced a patch that mitigates this vulnerability,” the advisory says.
Customers running vulnerable installations can get the updated firmware from Schneider’s site.
