ICS-CERT Publishes Two Advisories and an Update

Today the DHS ICS-CERT published a control system security advisory for products from Siemens and a medical device security advisory for products from Naus Xltek. They also updated a control system security advisory for products from Siemens.

NOTE: There are still three Siemens advisories and two Siemens updates that were announced by Siemens on Tuesday that have not been covered by ICS-CERT. I will address those in my Saturday post.

Siemens Advisory

This advisory describes a permissions, privileges and access controls vulnerability in the Siemens SCALANCE X switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C. The vulnerability was reported by Dr. Ang Cui and Joseph Pantoga from Red Balloon Security. Siemens has provided updates for some of the affected products. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker on the same local network segment could exploit the vulnerability to execute arbitrary code.

Natus Xltek Advisory

This advisory describes 8 vulnerabilities in the Natus Xltek NeuroWorks software. The vulnerabilities were reported by Cory Duplantis from Cisco Talos. Natus Xltek has produced an update to mitigate the vulnerabilities. There is no indication that Duplantix has been provided an opportunity to verify the efficacy of the fix.

The eight reported vulnerabilities are:

• Out-of-bounds read (4) - CVE-2017-2852, CVE-2017-2858, CVE-2017-2860, and CVE-2017-2861; and

• Stack-based buffer overflow (4) - CVE-2017-2853, CVE-2017-2867, CVE-2017-2868, and CVE-2017-2869.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device being accessed; a buffer overflow condition may allow remote code execution.

Siemens Update

This update provides additional information on an advisory that was originally issued on November 8, 2016 and then updated November 22^nd, 2016; December 23^rd, 2016; February 14^th, 2017; March 2^nd, 2017,  May 9^th, 2017, June 20^th, 2017, and again on January 25^th, 2018. The update provided corrected affected version numbers and a link to a mitigation measure for PCS 7 V8.2.