Flaw found in power-plant software

Flaw found in power-plant software

Summary: A vulnerability found in Wonderware SuiteLink could open a third of the world's industrial plants to a potential denial-of-service attack

TOPICS: Security

A hole has been found in software used by critical national infrastructure organisations including oil, gas and power companies that could lead to a successful denial-of-service attack.

The vulnerability is in a protocol used in versions of SuiteLink by Wonderware running on Microsoft Windows. The software is used to communicate between components in Supervisory Control and Data Acquisition (Scada) systems. The protocol is proprietary, and used over TCP/IP networks.

The flaw in the Wonderware SuiteLink Service, as reported by security researcher Sebastian Muniz  from Core Security Technologies, means unauthenticated client programs connecting to the SuiteLink Service prior to version 2.0 patch 1 can send a malformed packet that causes a memory allocation operation to fail, returning a null pointer.

Due to a lack of error-checking for the result of the memory allocation operation, the program later tries to use the pointer as a destination for memory copy operation, triggering an access violation error and terminating the service, reported Core Security.

The flaw is remotely exploitable, according to the Core Secure Technologies researcher. According to the Wonderware site: "One-third of the world's plants run Wonderware software solutions. Wonderware has sold over 450,000 software licences in approximately 100,000 plants worldwide, which is 33 percent of the world's 305,544 plants with 20 or more employees."

Software updates and advice on how to secure systems are available from the Wonderware website, and users must register on the site to view the advisory.

Topic: Security

Tom Espiner

About Tom Espiner

Tom is a technology reporter for ZDNet.com. He covers the security beat, writing about everything from hacking and cybercrime to threats and mitigation. He also focuses on open source and emerging technologies, all the while trying to cut through greenwash.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


1 comment
Log in or register to join the discussion
  • Is this news?

    So a bug was found and fixed in a reputable software product well in advance of announcing the presence of the problem. Is this news?
    I've worked for some competitors of Wonderware, and anyone even remotely familiar with control systems knows that such software should never be connected to the public internet, meaning that any hypothetical attack would have to launched from the local network on an unpatched system. Would anyone really think that is the most vulnerable target for any serious threat to critical national infrastructure organisations.