Intrusion Prevention

RealFlex.RealWin.Server.Malicious.Packet.Buffer.Overflow

Description

This indicates an attack attempt against a buffer-overflow vulnerability in Realflex RealWin Scada Server.
The vulnerability is caused by improper bounds checking in the "INFOTAG_SET_CONTROL" function. By sending a specially crafted packet to the server interface (default TCP/910), a remote attacker could overflow a buffer and execute arbitrary code on a vulnerable system.

Affected Products

DATAC Control International RealWin SCADA Server 2.0

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Upgrade to the latest version, available from the following web site: http://www.realflex.com/products/realwin/realwin.php

CVE References

CVE-2008-4322