Public ICS Disclosures – Week of 04-13-19

This week we have two vendor disclosures from CODESYS.

Gateway V3 Memory Management Advisory

CODESYS published an advisory describing an uncontrolled memory allocation vulnerability in the CODESYS V3 products. The vulnerability was reported by Martin Hartmann from cirosec GmbH. 3S has released a new version that mitigates the vulnerability. There is no indication that Hartmann has been provided an opportunity to verify the efficacy of the fix.

CODESYS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to cause a denial-of-service condition.

Gateway V3 Channel Management Advisory

CODESYS published an advisory describing two vulnerabilities in the CODESYS V3 products. The vulnerabilities were reported by Martin Hartmann from cirosec GmbH. 3S has released a new version that mitigates the vulnerabilities. There is no indication that Hartmann has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities (on a single CVE - CVE-2019-9010) are:

• Insufficiently random values to identify the communication channel; and

• Insufficiently verifies the ownership of a channel

CODESYS reports that a moderately skilled attacker could remotely exploit these vulnerabilities to close existing communication channels or to take over an already established user session to send crafted packets to a PLC.