Vulnerability Note VU#138633

Invensys Wonderware InTouch creates insecure NetDDE share

Overview

Invensys Wonderware InTouch 8.0 creates a NetDDE share that could allow an attacker to run arbitrary programs.

I. Description

Invensys Wonderware InTouch HMI Software is used in Supervisory Control And Data Acquisition (SCADA) systems.

Dynamic Data Exchange (DDE) was designed to allow Microsoft Windows applications to share data. NetDDE is an extension to DDE that was developed by Wonderware. NetDDE allows communications with local DDE applications and with remote NetDDE agents using NetBIOS. NetDDE is not supported in Windows Vista, but is included in Windows NT, 2000, XP, and Server 2003.

InTouch 8.0 creates a universal NetDDE share. The permissions applied to the share may allow a remote attacker to execute arbitrary programs. Windows access permissions apply to NetDDE connections, however if an attacker can obtain valid credentials, or possibly if anonymous connections are enabled, the attacker could connect to the NetDDE share and execute programs.

II. Impact

A remote attacker may be able to execute any application that accepts NetDDE connections.

III. Solution

Upgrade

This issue has been addressed in Wonderware InTouch version 9 and later. Wonderware administrators with active support contracts who do not want to upgrade can get an updated version of Wonderware 8.0. Wonderware Tech Alert 98 contains information about obtaining fixed software. Wonderware administrators can also contact Wonderware for more information about obtaining updates.

Restrict access

Per Micrososoft Security Bulletin MS04-031 (which describes an unrelated NetDDE vulnerability in Windows), blocking the below ports at perirmeter firewalls can prevent remote NetDDE connections.

• Ports 135/udp, 137/udp, 138/udp, 445/udp, 135/tcp, 139/tcp, 445/tcp, and 593/tcp
• All unsolicited inbound traffic on ports greater than 1024
• Any other specifically configured RPC port

Systems Affected

Vendor	Status	Date Updated
Invensys	Vulnerable	27-Nov-2007

References

http://us.wonderware.com/aboutus/whoweare/contactus.htm
http://pacwest.wonderware.com/web/News/NewsDetails.aspx?NewsThreadID=2&NewsID=201804
http://blogs.msdn.com/nickkramer/archive/2006/04/18/577962.aspx
http://msdn2.microsoft.com/en-us/library/ms648711.aspx
http://support.microsoft.com/default.aspx?scid=kb;en-us;125703
http://lists.immunitysec.com/pipermail/dailydave/2004-October/001014.html
http://www.digitalbond.com/index.php/2007/11/19/wonderware-intouch-80-netdde-vulnerability-s4-preview/

Credit

This vulnerability was reported by Neutralbit with assistance from Digital Bond.

This document was written by Ryan Giobbi.

Other Information

Date Public	11/19/2007
Date First Published	11/19/2007 10:38:25 AM
Date Last Updated	11/27/2007
CERT Advisory
CVE Name
Metric	0.57
Document Revision	22