Check Point Advisories

SCADA Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow

Vulnerability
Protection

Check Point Reference:	CPAI-2012-1328
Date Published:	26 Dec 2012
Severity:	Critical
Last Updated:	Thursday 21 November, 2024
Source:
Protection Provided by:	Security Gateway R75
Who is Vulnerable?	FactoryLink 7.5 FactoryLink 7.5 SP2 FactoryLink 8.0.1.703
Vulnerability Description	A stack buffer overflow in FactoryLink 7.5, 7.5 SP2, and 8.0.1.703. An attacker may be able to execute arbitrary code.
Vulnerability Details	Improper use of a vsprintf() function while processing the user-supplied text field.

Protection Overview

This protection will detect and block the transferring of a malicious data to the target host.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the SCADA Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: SCADA Protection Violation
Attack Information: SCADA Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow