Multiple vulnerabilities in NETxEIB OPC server
==============================================

OPC servers provide a standard way to interoperate automation and control
systems, bridging data from several industrial protocols such as DNP3,
MODBUS, etc. to a more standard data access interface. They are often used
in SCADA systems to consolidate network device information in a single
point; as such OPC servers are usually considered critical applications.

NETxAUTOMATION commercialises an OPC Server
("NETxEIB.MP.OPEN.OPC.Server.3.0"), more information is available at
http://www.netxautomation.com/.

ANALYSIS
--------

The product presents various security vulnerabilities, allowing an attacker
with access to the OPC interface to arbitrarily read and write the process
memory, potentially leading to the execution of attacker-provided code.

The vulnerabilities reside in the server implementation of the following OPC
Data Access interface methods:

 * IOPCSyncIO::Read
 * IOPCSyncIO::Write
 * IOPCServer::AddGroup
 * IOPCServer::RemoveGroup
 * IOPCCommon::SetClientName
 * IOPCGroupStateMgt::CloneGroup


By providing specially crafted OPC handles the attacker can force the server
to access arbitrary memory, both in read and write operations which can be
potentially leveraged to execute arbitrary code in the OPC server.

VULNERABLE VERSIONS
-------------------

The vulnerability has been verified to be present in the following version
of the server:

  Server name: NETxEIB MP Open OPC Server 3.0
  OPC Server CLSID: {AAEEF077-F162-4A1F-AD88-C37F35EA4030}
  ProgID: NETxEIB.MP.OPEN.OPC.Server.3.0
  Version: 3.0.125
  OS: Windows XP

The vulnerability was discovered during an OPC server group assessment for a
customer and is not known to be publicly exploited.

WORKAROUND
----------

The vendor has fixed the vulnerability and published an updated version.

ADDITIONAL INFORMATION
----------------------

This vulnerability was found and researched by:

  Lluis Mora        <llmora@neutralbit.com>
  Xavier Panadero   <xpanadero@neutralbit.com>

You can find the latest version of this advisory at:

http://www.neutralbit.com/

Disclosure timeline:

  12/Jan/2006: Vendor notified
  12/Jan/2006: US-CERT notified
  20/Mar/2006: Vendor published public advisory
  21/Mar/2006: Neutralbit advisory published

References:

  CERT: US-CERT Vulnerability Note VU#296593
  CVE:  CVE-2007-1313