Public ICS Disclosures – Week of 07-06-19

This week we have vendor disclosures from Schneider, Johnson Controls, and Siemens. We also have updates of previously issued advisories from Schneider (3) and Siemens (5).

Schneider Advisory

Schneider published an advisory that describes a buffer error vulnerability in the Schneider Modicon M580 controller product. The vulnerability is self-reported. Schneider has a new version that mitigates the vulnerability.

Schneider Updates

1. Schneider updated an advisory that was originally published on May 14^th, 2019 for a vulnerability in the Schneider Modicon Controller products. The new information corrected the CVSS v3.0 Base Score from 7.4 to 7.5.

2. Schneider updated an advisory that was originally published on May 23^rd, 2017 for a vulnerability in the Schneider Modicon Controllers and SCADAPack RTUs. The new information includes:

• Updated affected products section to include SCADAPack RTUs;

• Updated remediation section to include information for SCADAPack RTUs; and

• Updated researcher acknowledgment section

3. Schneider updated an advisory that was originally published on May 14^th, 2019 for multiple vulnerabilities in its Modicon Controller products.  The new information includes:

• Updated to include links to M580 V2.90 Firmware and Control Expert Hot Fix V14.0; and

• Updated mitigations for CVE-2019-6808

NOTE: I missed the original publication of the Schneider advisory, but I did report on the vulnerabilities when reported by Talos.

Johnson Controls Advisory

Johnson Controls published an advisory reporting an undescribed vulnerability in the Johnson Controls TrueInsight modules used to connect Simplex® Fire Alarm Control Panels to the TrueInsight Remote Service. This vulnerability is apparently self-reported. Johnson Controls has remotely disabled the modules with active customers.

Comment: Wow. This very brief advisory begs more questions than it answers. An 11-9-16 advertorial over on FacilityExecutive.com ‘reports’:

“SimplexGrinnell's True Insight Remote Service is an internet based software platform that provides SimplexGrinnell an electronic window into the operation of your entire simplex fire system 24/7.”

Remotely disconnecting the link between fire alarm control panels and this platform slams shut that ‘electronic window’. I hope that Johnson Controls notified their customers before they disconnected the system.

Siemens Advisory

Siemens published an advisory describing four microarchitectural vulnerabilities in Siemens Industrial Products. The vulnerabilities are self-reported. Siemens has produced some BIOS updates that include chipset microcode updates and recommends applying OS vendor updates that address these vulnerabilities.

The four reported vulnerabilities are:

• Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12126;

• Microarchitectural Load Port Data Sampling (MLPDS) - CVE-2018-12127;

• Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130; and

• Microarchitectural Data Sampling Uncacheable Memory (MDSUM) - CVE-2019-11091

Siemens Updates

1. Siemens published an update for Siemens Advanced Therapy Products from Siemens Healthineers an advisory that was originally published on May 24^th, 2019. The new information includes:

• Added mitigation; and

• Clarified affected versions

2. Siemens published an update for Siemens RAPIDPoint® 500 Operating on Windows XP that was originally published on May 24^th, 2019. The new information includes:

• Removed AUWi and AUWi Pro; and

• Changed patch release date

3. Siemens published an update for Siemens Laboratory Diagnostics Products from Siemens Healthineers that was originally published on May 24^th, 2019. The new information includes:

• Removed CS 5100 for Windows XP; and

• Added patch information

NOTE: These first three Siemens updates are all for the Microsoft® RDP vulnerability.

4. Siemens published an update for Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP that was last updated on June 11^th, 2019. The new information includes:

• Added CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091, CVE-2019-11477, CVE-2019-11478, CVE-2019-11479, CVE-2019-12900; and

• Changed NVD links to MITRE