Secunia

A security issue has been reported in OSIsoft PI Server, which can be exploited by malicious people to potentially disclose sensitive information and manipulate certain data.

The security issue is caused due to insufficient encryption being used during the authentication process. This can be exploited to potentially obtain login credentials and gain access to the PI Server databases.

Successful exploitation requires that PI User accounts are in use.

Solution
Update to version 3.4.380 or later and migrate to the integrated Windows authentication, or follow the workaround steps described in the vendor's advisory.

Provided and/or discovered by
Eyal Udassin, Jonathan Afek, and Yaron Budowsky of C4 Security

Changelog
Further details available in Customer Area

Original Advisory
C4 Security:
http://www.scada-security.com/vulnerabilities/osisoft1.html

OSIsoft:
http://techsupport.osisoft.com/Bulletins/4/224a5434-ba62-41d1-83eb-244ba60da193.htm

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area