|CVSS SCORE||9.3, (AV:N/AC:M/Au:N/C:C/I:C/A:C)|
|TREND MICRO CUSTOMER PROTECTION||Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['21029']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com|
The specific flaw exists within the implementation of the 0x13C80 IOCTL in the BwOpcTool subsystem. A stack-based buffer overflow vulnerability exists in a call to strcpy using the NodeName parameter. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system.
09/15/2015 - 09/17/2015 - ZDI disclosed reports to ICS-CERT (+1 more on 9/29/2015).
Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx and numerous other Microsoft Knowledge Base articles.