TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Hello,
On Mon, Oct 01, 2001 at 01:21:56PM +0200, Patrick Coomans wrote:
> Hi,
> Sorry to be off-topic a bit, but this matter is crucial to me since
I am researching the vulnurability of (industrial automation)
PLC's to remote cyberterrorism or hacking.
It relates to ISS (in this case an advisory, as opposed to a
product) so that makes it "on topic", at least in my book. (and since I'm
the moderator...) The problem was also uncovered during some of our
product development and testing, as well.
> On another forum I heard about a security advisory that was released by
ISS about Allen Bradley PLC's but I can't find a trace of this.
> Anyone have an idea?
Must be my day. Since I was the researcher and author on that
particular advisory, I guess I know something about it. :-) The advisory
was regarding an indeterminant class of PLCs from various vendors using
the OS-9 operating system from Microware and, in particular, Allen Bradley
controllers. The problem is with the OS-9 operating system and is not just
peculiar to Allen Bradley. The advisory dates back to 1998.
At one point, Microware claimed to have fixed the problem. But
they never got back with me with any update information.
You can find our advisory here:
<http://xforce.iss.net/alerts/advise14.php>
You can also find the CVE entry for this problem here:
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0265>
> Thx,
> Patrick
Regards,
Mike
--
Michael H. Warfield, | Main: (404)236-2600 Direct: (404)236-2807
Senior Researcher - X-Force | Cell: (678)463-0932
Internet Security Systems, Inc. | E-Mail: [EMAIL PROTECTED] [EMAIL PROTECTED]
6303 Barfield Road | http://www.iss.net/
Atlanta, Georgia 30328 | http://www.wittsend.com/mhw/
| PGP Key: 0xDF1DD471
