Security researcher Andrew Brooks have reported a vulnerability that may occur when a specially crafted HTML document is opened with ActiveX enabled browser, typically Microsoft I.E.. Successful exploitation may crash the said browser. This attack has no impact on IntegraXor SCADA server itself.
IGX developers have taken proactive step to patch the reported vulnerability immediately on the next day, and has been included in latest Release which can be obtained at this link: http://www.integraxor.com/download/beta.msi?4.00.4283. All previous release before build 4283 will have this vulnerability impact. Please download and use this build or any future release to fix this ActiveX enabled browser vulnerability.
We wish to take this opportunity to remind user that IntegraXor SCADA mimic can run completely on standard compliant web technologies and do not rely on any plugin developed using ActiveX nor Java Applet system like other old-fashioned web system. As such please do not accept any suspicious external ActiveX content (web page) when running IntegraXor. User who use Firefox, Chrome or Safari will not be affected by this vulnerability.
Summary of Event
- 12-Dec-2012: ICS CERT Contacted IntegraXor support team.
- 13-Dec-2012: Technical report for the vulnerability is received and POC is acknowledged.
- 14-Dec-2012: Security fixed is issued as release candidate for general download.
- 03-Jan-2013: Security researcher(s) confirmed the vulnerability issue has been fixed.
- 03-Jan-2013: Public announcement is made by IntegraXor support team.