ICS-CERT Publishes 3 Advisories and Updates 2

Yesterday the DHS ICS-CERT published three control system security advisories for products from Yokogawa, GE and Delta Industrial. They also updated one medical device security advisory for products from Silex and an industrial control system security advisory for products from Rockwell.

Yokogawa Advisory 

This advisory describes a hard-coded credential vulnerability in the Yokogawa STARDOM Controllers. The vulnerability was reported by VDLab of Venustech and Dongfang Electric Corporation. Yokogawa has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to gain access to the affected device, which could result in remote code execution.

GE Advisory 

This advisory describes three vulnerabilities in the GE MDS PulseNET and MDS PulseNET Enterprise products. The vulnerability was reported by Andrea Micalizzi (rgod). GE notes that the latest version mitigates these vulnerabilities. There is no indication that rgod was provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper authentication - CVE-2018-10611;

• Improper restriction of XML external entity reference - CVE-2018-10613; and

• Relative path traversal - CVE-2018-10615

ICS-CERT reports that that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow elevation of privilege and exfiltration of information on the host platform.

Delta Advisory

This advisory describes three vulnerabilities in the Delta Industrial Automation DOPSoft HMI editing software. The vulnerabilities were reported by B0nd @garagehackers via the Zero Day Initiative. Delta notes that the latest version mitigates the vulnerabilities. There is no indication that the researcher was provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Out of bounds read - CVE-2018-10623;

• Heap-based buffer overflow - CVE-2018-10617; and

• Stack-based buffer overflow - CVE-2018-10621

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to read sensitive information, execute arbitrary code, and/or crash the application.

Silex Update

This update provides additional information on an advisory that was originally reported on May 8^th, 2018. The update provides a link to a new version of GE MobileLink/GEH-SD-320AN.

Rockwell Update

This update provides additional information on an advisory that was originally published on May 10^th, 2018 and subsequently updated on May 24^th, 2018. The update corrects the link to the Rockwell advisory.

ICS-CERT Publishes One Advisory and Updates Another

Today the DHS ICS-CERT published a new control system security advisory for a product from CA Technologies. Earlier this week I missed the fact that they also updated a previously published (and much updated) advisory for multiple products from Siemens.

CA Technologies Advisory

This advisory describes a directory traversal vulnerability in the CA Technologies Unified Infrastructure Management application. The vulnerability was reported by Andrea Micalizzi (rgod), working with Zero Day Initiative. CA Technologies has produced an update to mitigate the vulnerability. There is no indication that Andrea has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to create or overwrite critical files that are used to execute code, such as programs or libraries.

The CA Technologies Security Notice (not referenced in the ICS-CERT Advisory) includes two additional vulnerabilities:

• Insecure handling of session id’s - CVE-2016-9164; and

• Path traversal information disclosure - CVE-2016-9165

Latest Siemens Update

This update provides updated affected version information for SIMATIC S7 products. It also provides links for new updates for various SIMATIC S7 products. The latest update of the Siemens Security Notification also notes that Siemens corrected fix information for PCS 7 V8.0 and V8.1.