No. 1 Story

HP job cuts loom for Australian employees

A number of Australian employees of Hewlett-Packard are facing the loss of their jobs as the global computer giant looks to slash its worldwide workforce by up to 30,000.

read more

Related Articles

Critical, Infrastructure, exploitable, vulnerability, will, not, patched
Today's release of the report "In the Crossfire: Critical Infrastructure in the Age of...
The Month of Apple Bugs may be over, but Kevin Finisterre hasn't given up...
Early WiMAX networks will have a number of security vulnerabilities, according to ABI Research,...
Security vendor Sophos claims that presently Apple is not displaying the correct name for...
The debate has flared up once again about whether users should wait for an...

Critical Infrastructure exploitable vulnerability will not be patched

Business IT - Security

In April this year, a vulnerability was discovered in a commonly used critical infrastructure Web Access product.  Exploitable code was also made available.  The manufacturer has announced that no patch will be released.

According to ISC-CERT, advisory ICSA-11-094-02A spells out the following:

'Independent security researcher Rubén Santamarta has identified details and released exploit code for a Remote Procedure Call (RPC) vulnerability in Advantech/BroadWin WebAccess. This is a web browser-based human-machine interface (HMI) product. This RPC vulnerability affects the WebAccess Network Service on 4592/TCP and allows remote code execution.

'Advantech/BroadWin has notified ICS-CERT that a patch will not be issued to address this vulnerability.'

Allow me to repeat that.  A simple RPC exploit in software that is used for a variety of critical infrastructure projects WILL NOT BE PATCHED.

Worse, the company continues to sell the product with absolutely no advice on its web site (visible to this writer) that there is an issue.

Well-known SCADA security expert Dale Peterson was so astonished by this action that he was moved to create a new Insecure Products List currently with just one entry.

Peterson's thoughts are on the next page.