Schneider Electric Software Update Remote Arbitrary Code Execution Vulnerability

Release date:
Updated on: 2013-01-22

Affected Systems:
Schneider Electric Unity pro0 6.0
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57438
CVE (CAN) ID: CVE-2013-0655
 
Schneider Electric Software is widely used in energy and industrial systems. Schneider Electric Software Update (SESU) is a service used to centrally upgrade Schneider Electric Software on Windows PC.
 
The vulnerability is that the SESU client does not correctly verify the source of the upgrade package and data transmission uses the HTTP protocol. Through man-in-the-middle attacks, attackers can exploit this vulnerability to spoof updates and obtain the ability to execute arbitrary code on the device where the SESU client is located.
 
Schneider Electric updated the SESU client in February January 2013 and added support for the HTTPS protocol to fix the vulnerability.
 
<* Source: Arthur Gervais

Link: http://secunia.com/advisories/51849/
Http://www.us-cert.gov/control_systems/pdf/ICSA-13-016-01.pdf
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Schneider Electric
------------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.global-download.schneider-electric.com/852575A6007E5FD3/All/109B6EDDBD18DB218525770D002DB