ICS-CERT Publishes 2 Advisories and 4 Updates

Yesterday the DHS ICS-CERT published a control system security advisory for products from Lantech. They also published a medical device security advisory for products from Philips. Additionally, they updated four previously published security advisories for products from Siemens (2), Nari, and Schneider.

Lantech Advisory

This advisory describes two vulnerabilities in the Lantech IDS 2102 Ethernet device server. The vulnerabilities were reported by Florian Adamsky. Lantech has not responded to ICS-CERT on these vulnerabilities.

The two reported vulnerabilities are:

• Improper input validation - CVE-2018-8869; and

• Stack-based buffer overflow - CVE-2018-8865

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to execute arbitrary code on the system through crafting malicious input.

Philips Advisory

This advisory describes three vulnerabilities in the Philips Brilliance CT Scanners. These vulnerabilities were self-reported. Philips has a new version that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Execution with unnecessary privilege - CVE-2018-8853;

• Exposure of resources to the wrong sphere - CVE-2018-8861; and

• Use of hard-coded credentials - CVE-2018-8857

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to execute software or to view/update files including patient health information (PHI), directories, or system configuration.

NOTE: These vulnerabilities were not reported on the FDA Medical Device Safety Communications web site.

PROFINET Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th,  November 28^th, 2017, January 18^th, 2018, January 25^th, 2018, January 27^th, 2018 and most recently on March 6^th, 2018. The new information includes updated version information and links to new versions for:

• SIMATIC CP 343-1 Std; and

• CP 343-1 Lean

Industrial Products Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th and most recently February 27^th, 2018. The new information includes updated version information and links to new versions for:

• SINAMICS G130;

• SINAMICS G150;

• SINAMICS S120; and

• SINAMICS S150

These two updates were published yesterday by Siemens. Siemens also announced three new advisories (here, here, and here) and one additional update (here). I suspect that ICS-CERT will publish their advisories and updates next week.

Nari Update

This update provides additional information on an advisory that was originally published on January 25^th, 2018. Nari has released a new version that mitigates the vulnerability. There is no indication that the researchers from Kaspersky labs that initially reported the vulnerability have been provided an opportunity to verify the efficacy of the fix. When ICS-CERT published their initial report they had received no response from Nari.

Schneider Update

This update provides additional information on an advisory that was originally published on April 17^th, 2018. The new information includes:

• Revises attacker characterization (now “high skill level”);

• Changed CVSS base score to 9.0 (from 10.0) and the CVSS vector string for vulnerability #1;

• Changed the CVSS vector string for vulnerability #2; and

• Completely re-wrote mitigations section to include links to Schneider advisory and ICS-CERT Yara rule