ICS-CERT Publishes 4 Advisories – Only 1 HeartBleed

Today the DHS ICS-CERT published four advisories for vulnerabilities in industrial control systems. The included vulnerabilities from InduSoft, Festo, Siemens and Certec. Only one advisory deals with HeartBleed. The advisory of note shows that ICS-CERT can get upset with vendor inaction.

InduSoft Advisory

This advisory describes a path traversal vulnerability in the InduSoft Web Studio application. It was reported by John Leitch in a coordinated disclosure through the Zero Day Initiative (ZDI). This advisory was originally released on the US-CERT secure portal on April 17^th. A patch is available, but there is no indication that its efficacy has been evaluated by the researcher.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to gain further access that would allow arbitrary code execution.

Festo Advisory

This advisory describes multiple vulnerabilities in the Festo PLC. The vulnerabilities were reported by Reid Wightman of IOActive in a coordinated disclosure. ICS-CERT reports that Festo has opted to not address these vulnerabilities. The vulnerabilities include:

• Improper authentication (FTP Backdoor), CVE-2014-0760;

• Improper authentication (two unauthenticated ports), CVE-2014-0769;

• Improper access controls (using outdated CoDeSys runtime module), CVE-2012-6068; and

• Directory traversal (same outdated CoDeSys module), CVE-2012-6069

ICS-CERT reports that a relatively low skilled attacker could use publicly available code to remotely exploit these vulnerabilities.

I want to commend ICS-CERT for getting angry in one of their advisories, this is a situation that certainly appears to deserve an adversarial response. I think the best statement from ICS-CERT can be found in the Overview section of the Advisory:

“This advisory is being published to alert critical infrastructure asset owners of the risk of using this equipment [emphasis added] and for them to increase compensating measures if possible.”

I read Reid’s TWEET® about this advisory earlier today and was kind of surprised at his reaction. I am not surprised now. Again, kudos to ICS-CERT for reacting to this callous disregard for customer security. It will be interesting to see if there is a change in attitude Esslingen am Neckar, FRG.

Siemens Advisory

This advisory addresses two vulnerabilities in the Siemens SIMATIC S7-1200 PLC family. This is a mix of self-reported and researcher reported vulnerabilities. The researchers from OpenSource Training are Ralf Spenneberg, Hendrik Schwartke, and Maik Brüggeman. Siemens reports that they have produced a new version that mitigates the vulnerabilities though there is no indication that the researchers have validated the efficacy of the fix. The vulnerabilities include:

• Cross site scripting, CVE-2014-2908; and

• Improper neutralization of CRLF sequences, CVE-2014-2909

ICS-CERT reports that it would take a skilled attacker with physical access gaining the assistance of an authorized user to exploit these vulnerabilities. A successful exploit could result in a DoS attack.

Certec Advisory

This advisory is the one that was foretold in yesterday’s blog post about ICS-CERT HeartBleed publications. The Certec atvise SCADA product is susceptible to the HeartBleed bug. An update that includes a newer version of the OpenSSL software has been made available.

ICS-CERT Publishes 5 Advisories by the Numbers

Five separate advisories were published by the DHS ICS-CERT folks today and there are a lot of other interesting numbers involved. First there are two new sets of vulnerabilities from coordinated disclosures and three sets following up alerts for uncoordinated disclosures. Next there are two advisories from Luigi and one from Basecamp. Then there are two Siemens advisories for different devices by different researchers. Finally we have a real first; a vulnerability reported in a cybersecurity device.

Siemens

Siemens has two new devices now listed on the ICS-CERT list of vulnerable control systems applications; Scalance S and Scalance X. The similarities in names is apparently due to both being communications devices; Scalance X is an ‘Industrial Ethernet Switch’ and Scalance S is a security module that includes a ‘Stateful Inspection Firewall’. Vulnerabilities in either could open an otherwise secure network to attack.

The two vulnerabilities reported in Scalance S were disclosed to Siemens by Adam Hahn and Manimaran Govindarasu. The vulnerabilities are a brute-force authentication vulnerability and a stack-based overflow vulnerability. Both are remotely exploitable by a moderately skilled attacker and could result in a DOS or possibly arbitrary code execution. Siemens has a firmware update and a security advisory to ‘resolve’ these vulnerabilities. Interestingly ICS-CERT does not say that the researchers have verified the resolution of these vulnerabilities.

There is just a single buffer overflow vulnerability reported in the Scalance X by Jürgen Bilberger from Daimler TSS GmbH directly to Siemens.  This is a remotely exploitable vulnerability that could be exploited by a moderately skilled attacker. A successful exploit could result in a DOS or execution of arbitrary code. Siemens has a firmware update for this vulnerability that, again, the advisory says ‘addresses the vulnerability’ without saying that the researcher has verified that claim.

I’m not sure how ICS-CERT was notified about these vulnerabilities since both advisories clearly state that the disclosures were directly to Siemens. I would probably assume that the notification was made by Siemens and that would certainly be a positive move from a company that a large number of people associate with their insecure-by-design PLCs.

Luigi Uncoordinated Disclosures

Two of today’s advisories were follow-ups to alerts due to uncoordinated disclosures last year by Luigi. One of the advisories references the earlier alert, but the other does not. What’s really unusual about that is that another advisory for the same product, the MICROSYS Promotic HMI, where ICS-CERT did not reference the original Luigi related alert. To the best of my knowledge these are the only two instances where an earlier alert was not referenced in the advisory; strange coincidence that they both are about the same product reported by the same researcher.

The Promotic vulnerability is for a ‘use after free’ condition that would allow an attacker to corrupt data or possibly execute arbitrary code. Remote execution is not possible as the exploit requires a local user to run a vulnerable project file. MICROSYS notes that the latest version of Promotic does not contain this vulnerability so users can just download the latest version to correct the problem.

The second advisory is for the Certec webMI2ADS HMI application, or maybe it is the atvise webMI that they referenced in the original alert. There has been more than a little confusion in naming protocols in systems upon which Luigi has reported. This is probably due to the fact that Luigi is operating out of Italy and names do change in different countries.

The Certec advisory addresses four separate vulnerabilities;

• Directory traversal;

• Null pointer;

• Termination of software; and

• Resources consumption

These vulnerabilities are remotely executable that a relatively low skilled attacker could exploit to cause a DOS or perhaps access ‘sensitive data’. Registered users can download a new version of the application that does not contain these vulnerabilities. The Advisory reports that Luigi has confirmed that the update ‘resolves these vulnerabilities’.

Basecamp

The Basecamp related advisory concerns the vulnerabilities identified in the Koyo ECOM1000 Ethernet Module. Reid Whitman was responsible for the original disclosure as part of the Basecamp presentations at the S4 Conference in January. There were five vulnerabilities identified in this product;

• Buffer overflow;

• Weak password requirements;

• Web server cross-site scripting;

• Web server requires no authentication; and

• Uncontrolled resource consumption.

All of the vulnerabilities are remotely exploitable allowing a moderately skilled attacker to exploit these vulnerabilities. Koyo has a produced a patch that addresses each of these vulnerabilities with varying degrees of effectiveness. The web server, for example, is now disabled by default but the module can reconfigured by the user to enable the web server and apparently re-opening the vulnerability.

ICS-CERT Upgrades Schneider Alert and Issues New Luigi Advisory

Today the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published two new advisories covering vulnerabilities in two ICS systems. The first upgrades an alert from December concerning multiple credential vulnerabilities in various Schneider systems and the second addresses a vulnerability in Certec’s atvise SCADA/HMI product.

Schneider Vulnerabilities

This advisory upgrades the information on an alert on various Schneider ICS products that was published last month. As noted in that alert that there were three separate hard-coded credentials in various Schneider applications involving the Telenet port, Windriver Debug port and the FTP service. This advisory confirms the earlier report that Schneider has developed and has now made available patches to deal with the vulnerabilities in the first two services, but the FTP service remains vulnerable to attack on some portion (maybe all, it is not clear in the advisory) of the affected systems. Schneider is continuing to work on a mitigating patch for the remaining vulnerable service.

Interestingly enough, the patches now available remove the vulnerable services (more accurately two of the vulnerable services) from the products. They were apparently included to allow remote maintenance and diagnostics of the products. Again, apparently this was the reason for the hard-coded credentials; it did not allow the owner-operator to inadvertently lock-out Schneider’s access to the system. Of course it did not allow the owner-operator to deliberately lock-out Schneider either and that is a security issue; the lack of access control.

Once again, I want to raise the issue about access to critical systems at high-risk chemical facilities. CFATS requires that anyone with unaccompanied access to critical systems at high-risk chemical facilities must be vetted against the Terrorist Screening Database (TSDB) and have other unspecified background checks completed before they can be given access to the critical systems at the facility. Who is going to ensure that all of the techs at Schneider (and any other vendor with remote access to control systems) have been properly vetted in accordance with the CFATS regulations?

NOTE: The CVE file for these vulnerabilities is already available.

Certec Vulnerability

The second advisory is for a newly reported vulnerability in the Certec’s SCADA/HMI product; atvise. The unnamed vulnerability (The advisory actually calls it a “denial of service (DoS) vulnerability”, but that describes the result of an attack not the vulnerability.) was reported by our old friend Luigi. Since this is an ‘advisory’ instead of an alert and it includes a mitigation, it would appear that Luigi has completed his second or maybe third coordinated disclosure. Actually, that’s not fair; Luigi’s name appears next to a number of upcoming ZDI (Zero Day Initiative) advisories.

This Voldemort vulnerability (okay forgive the Harry Potter® reference; Lord Voldemort is most often referred to in the series as ‘he who cannot be named’ because he is soooo evil) would allow a low skill level attacker to remotely execute a DOS attack. Certec has created a new version of atvise that does not have the vulnerability; it is available on their web site.

NOTE: The CVE link for this vulnerability is provided but the file is not yet active.