Tuesday, January 11, 2011

WellinTech issues security patch to address the vulnerability in KingView 6.53

WellinTech released a patch addressing the heap based buffer overflow vulnerability in KingView version 6.53, what is now defined as CVE-2011-0406, according to the National Vulnerability Database (NVD).

WellinTech's vulnerability disclosure included a short paragraph about the vulnerability which was published on the Chinese version of their website and not on the English version as of December 15, 2010.

In addition, the archived patch (.rar) doesn't have any changelog or release notes, i.e., information about the security vulnerability and what issues are addressed in the patch. This is obviously not what most in the software industry would consider best practices.

In fact, the archive doesn't contain any information relating to the impact or vulnerability and there are no CNVD reference pointers, because CNVD never published anything about the vulnerability even after the patch went out. How do you explain that?

My question to WellinTech is, "Do you always issue critical software updates relating to security vulnerabilities without releasing a history of changes bundled with the patch?"

According to the response on WellinTech's website, the vulnerability was covered in about two sentences. Most of which consisted of the vendor giving all credit to the China National Vulnerability Database (CNVD), without any mention of my discovery, disclosure, and the trigger they received back in September 2010.

Even though WellinTech would rather not acknowledge that an independent security researcher discovered a critical flaw in their product, they still have a certain amount of responsibility to respond to all parties involved.

By disclosing the vulnerability to WellinTech, CN-CERT and US-CERT I am confident that I have done the right thing. I was only trying to help and assist with the issue affecting KingView. I might have prevented a catastrophic event from taking place. As an example, one need not look too far into the past to reflect on what happened with Stuxnet, which was essentially a bundle of zero-day exploits inside a worm.

In fact, just for the record, this is not the first SCADA software vulnerability I have disclosed. Sometime between 2009 and 2010, I reported a vulnerability involving a product by the software company SIELCO SISTEMI. I reported a vulnerability in the product Winlog Lite which was subsequently patched within a short period of time. The vendor responded within 10-15 days and promptly issued a patch along with a very pleasant email thanking me for reporting the bug.

I am very suspicious as to why WellinTech kept the disclosure so quiet. I believe the public will eventually start asking questions about why CN-CERT, CNVD and WellinTech were so illusive.

The vulnerability information WellinTech provided is only available in Chinese, even though they have a version in English.

Pay close attention to the path in the URL.

Disclosure:

    http://www.kingview.com/news/detail.aspx?contentid=528

The Chinese version of the patch:

    http://download.kingview.com/software/kingview%20Chinese%20Version/nettransdll.rar

Where is the English version?

If the Chinese version of the patch works with the English version of KingView 6.53, then why not update the English web site?


I'm not going to let the actions of one vendor in China keep me from disclosing other vulnerabilities in the future relating to Chinese software. 

When people deserve reward, this should be duly noted even if you personally detest them. When people deserve punishment, this should not be forgone even if they are close to you...
 Mei Yaochen

 Update:

10:52 PM CST 1/12/2011

As of 1/12/2011  China's National Vulnerability Database has disclosed an advisory for WellinTech's KingView 6.53 HistorySvr heap buffer overflow vulnerability.

http://www.cnnvd.org.cn/showCnnvd.html?id=2011010108

I am very pleased to see the information is now available to the general public.

46 comments:

  1. Can be Kingview used to build a data information service platform in the automation field? To get more info on this theme please visit my Homepage.

    ReplyDelete
  2. Hi! Your article is very informative; it can really help me to write my essay. Thanks a lot)

    ReplyDelete
  3. I always shared your site post with my friends. Keep posting and i will follow you..Custom papers.

    ReplyDelete
  4. Interesting post! Click Homepage to learn more.

    ReplyDelete
  5. Well written! Visit our Homepage to know how writing service can help you!

    ReplyDelete
  6. Thanks for interestin Post! Please, visit my Homepage to get essay writing help from professional

    ReplyDelete
  7. Good post! http://www.express-essays.com- is a leader in the writing industry. Our customers are always satisfied with their custom papers.

    ReplyDelete
  8. An academic level has to be very important thing for every student. What companies should aid students in best dissertation just about this post creating? We could propose to buy the thesis in the writing services . I hope that this advice would help scolars!

    ReplyDelete
  9. Interesting post. By the way, students do not have to worry anymore about writing essays. Using first-rate custom essay writing service, that are available 24/7, learners will always get professionally written essays.

    ReplyDelete
  10. The learning is done in making of assignments and essay writing. The students learn lots of things and abilities are enhanced. The student becomes more skillful and able person. He can undertake different tasks of education very easily by hiring professional writers in budgeted price.

    ReplyDelete
  11. Great article! It is not easy to stydy at school. Especially when you have to write various essays, papers etc. But students can get great help with all their assignments, because it is a hard to be successful in all. That is why the best essay writing services for you.

    ReplyDelete
  12. Your idea give me a new era about how to learn & best essay writing service reviews.I think it give new concept about writing a creative essay.Thanks for it share with us.

    ReplyDelete
  13. You know, essay writing is not always easy. If you need some help, click here for essay writing service

    ReplyDelete
  14. completely forgot about the essay i had to write. I was lucky to use http://www.best-essays-writers.org/ service and was rewarded with the perfect essay for low price. Just have a peek here

    ReplyDelete
  15. Cool article! My brother - developer would nlike it veru much=) And I an an essay writer - I earn money by writing essays for students. If you want to buy an essay online for cheap find reliable essay service and forget about your academoc problems=)

    ReplyDelete
  16. Brilliant! This is a really marvelous stuff for me. Must agree that you are one of the coolest blogger. I was curious to see a stuff like Essay writing services in uae Fabulous post!

    ReplyDelete
  17. Smartphone Security Apps Assac Networks’ mobile phone/smartphone security app provides 360° protection against tapping and data theft from your mobile phone.

    ReplyDelete
  18. Hello, it is very importent question! I think it is very needed for all students! By the way, I want to recommend the bes help in writinh home tasks! It is very professional team of writers save your money and time! They are the best) http://custom-writing.net

    ReplyDelete
  19. Great and useful advice as for me,thanks a lot!If you someday looking for essay www.advanced-writer.com please welcome here.

    ReplyDelete
  20. I am very pleased to have found such an amusing article here. Keep up thr=e good work guys! And, of course, don't forget to visit http://proofreading-services.org/professional.php for your academic needs!

    ReplyDelete
  21. Thanks for this informative and interesting post. Also, if you feel that writing is not your strong point,in this case, welcome to http://www.essays-shark.net where you`ll get first-class services

    ReplyDelete
  22. Thanks for interesting article! If for some reason you can't write an essay or your find it difficult, please contact first class writers http://essay-mania.com.

    ReplyDelete
  23. Super info about apps. I have majority of them installed on my PC. Thanks for sharing, these apps are really very helpful especially in the university and college studying. But the most helpful is www.papers-writings.comwhere I always ordered my writings!

    ReplyDelete
  24. Nice and useful content, I am glad to read all this information. Thank you for your work. I would like to recommend http://www.academic-writings.com for everyone who are looking for excellent academic paper writing assistance on any topic.

    ReplyDelete
  25. Thanks for this post! I very grateful! I must say true that some times have difficulties with my assignments! I begin write but after some times i back to the way I was, in beginning, and this trouble i have every time, when not have inspiration! This why i began order my assignments on site http://essay-professors.com , and must say that i very satisfied!

    ReplyDelete
  26. Amazon Rolex timepiece is known for both their perfection and elegance. Such a sterling mixture of elegance and quality may be the reason why they control such a high price. Every person internet websites a Rolex snacks it like a valued ownership. If you own a Rolex and want to treasure it permanently, then you have to understand how to take good appropriate proper your observe. A simple appropriate care and primary servicing system will not only keep your Rolex in ideal performing situation for years to come, but will offer the feel that you are dressed in a product new Rolex every time you use your observe.

    Rolex Watch naaptol Lahore

    ReplyDelete
  27. How this vulnerability can be removed and changed in the strength ? what are the possible solutions. SEO Marketing Company

    ReplyDelete
    Replies
    1. I have read your blog its very attractive and impressive. I like it your blog.

      Java Training in Chennai Core Java Training in Chennai Core Java Training in Chennai

      Java Online Training Java Online Training Core Java 8 Training in Chennai Core java 8 online training JavaEE Training in Chennai Java EE Training in Chennai

      Delete
  28. Java Homework Help
    I need to support that you proceed with your incredible occupation, have a decent day.

    ReplyDelete
  29. Marketing Research Homework Help
    I really wanted to send a small word to say thanks to you for the fantastic points you are writing on this site.

    ReplyDelete
  30. Sure such as good articles post in this glod and fabulous i am very good site post Thanks for this nice article,
    Financial Analysis Homework Help

    ReplyDelete
  31. Online Assignment help
    I am feeling good to post this comment here, this is such a enjoyable moment and I want to visit this website again.

    ReplyDelete
  32. I appreciate this work amazing post for us I like it.
    harvard case study solutions

    ReplyDelete
  33. Pretty helpful material, much thanks for this article
    programming homework

    ReplyDelete
  34. I like this post so much! Thanks a lot for sharing! http://www.essay-experts.org/

    ReplyDelete
  35. Very interesting article. This is the informative resource for those who want to learn more about this topic. This is also the high-quality educational http://www.grand-essays.com/ resource where they can find professional help for writing quality original assignments.

    ReplyDelete