ABB PCU400 4.4-4.6 Remote Buffer Overflow

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052486 漏洞类型
发布时间 2008-09-26 更新时间 2008-09-26
漏洞平台 N/A CVSS评分 N/A
Vendor product information:

PCU400 is the modern product when implementing an effective data acquisition network in SCADA-based systems

PCU400, Process Communication Unit 400 forms the communication interface to the network of remote terminal units (RTUs) together with the RCS Application Software located in the application server of a Network Manager SCADA system. 
The PCU400 can be used as a SCADA front-end, communication gateway for Substation Automation systems or as a standalone protocol converter. 
Two parts define the Data Acquisition system:
    * RCS Application, a software package running in the Application Server
    * PCU400, a front-end converter that implements the protocols and connects the physical lines

PCU 400 can be used in a variety of configurations to cater for different network topologies and different levels of fault tolerance in the system. The alternatives include single or redundant PCU 400 units. 

A buffer overflow exists in the component that handles IEC60870-5-101 and IEC60870-5-104 communication protocols.
The vulnerability was exploited by C4 to verify it can be used for arbitrary code execution by an unauthorized attacker.
The description of the vulnerability is intentionally limited as this software controls critical national infrastructure.

An attacker can compromise the server which runs PCU400, which acts as the FEP server of the ABB SCADA system. 
This vulnerability is another method to carry out the "field to control center" attack vector mentioned in C4's S4 2008 paper "Control System Attack Vectors and Examples: Field Site and Corporate Network", which will allow the attacker to control other RTUs connected to that FEP.

In addition, an attacker can use his control over the FEP server to insert a generic electric grid malware as specified in our SysScan08 presentation, in order to cause harm to the grid.

Both documents are available at .

Affected Versions
PCU400 4.4
PCU400 4.5
PCU400 4.6
Other versions may be vulnerable, as they were not tested.

The vendor issued a hotfix to resolve this vulnerability.

Additional Information
For additional information please contact us at 
Note that we will respond only to verified utility personnel and governmental agencies.
The CVE identifier assigned to this vulnerability by CERT is CVE-2008-2474

This vulnerability was discovered and exploited by Idan Ofrat of C4.