ICS-CERT Publishes 5 Advisories

This morning DHS ICS-CERT published five advisories for industrial control system vulnerabilities. The affected systems come from GE, Elipse, SCADA Engine, ABB, and CIMON.

GE Advisory

This advisory describes a predictable TCP sequence vulnerability in GE Digital Energy’s Hydran M2 device. The vulnerability was reported by Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech. GE has eliminated this vulnerability in versions of the product produced after October 2014. There is no indication that the researchers have verified that the vulnerability has been removed from newer versions of the device. This vulnerability was originally reported on the US-CERT Secure Portal on February 10^th.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to send counterfeit packets as if they came from the device.

Since the vulnerable devices cannot be fixed they either have to be replaced or protected by other measures which would isolate them from the attack.

Elipse Advisory

This advisory describes a process control vulnerability in the Elipse E3 application; the vulnerability is actually located in a third-party (Telerik) DLL. The vulnerability was reported by Ivan Sanchez from Nullcode Team. Elipse has produced a new version which mitigates the vulnerability. ICS-CERT reports that Sanchez has verified the efficacy of the fix.

ICS-CERT reports that the vulnerability could not be remotely exploitable but goes on to explain that a social engineering attack could cause an authorized operator to load a compromised DLL.

ICS-CERT reports that Telerik has notified its other affected customer of the problem with its DLLs and has provided them with updated version that do not include the vulnerability. Hopefully those other un-named vendors will notify their customers of the vulnerability.

SCADA Engine Advisory

This advisory describes three vulnerabilities in the SCADA Engine BACnet OPC Server. These vulnerabilities were reported by Josep Pi Rodriguez. SCADA Engine has produced a new software version that mitigates the vulnerabilities. ICS-CERT reports that Rodriquez has verified the efficacy of the fix.

The three vulnerabilities are:

● Heap-based buffer overflow - CVE-2015-0979;

● Input validation - CVE-2015-0980; and

● Authentication - CVE-2015-0981

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to execute arbitrary code or modify the OPC Server database.

ABB Advisory

This advisory reports on the CodeWright HART DTM vulnerability in ABB products. The base information provided in this advisory is the same as that found in the latest version of the CodeWright advisory. ICS-CERT reports that ABB has begun to integrate the new CodeWright library but ABB reports that they have updated versions for the affected products which include the corrected CodeWright libraries.

CIMON Advisory

This advisory describes a DLL hijacking vulnerability in the CIMON CmnView.exe application. The vulnerability was reported by Ivan Sanchez of Wise. CIMON has produced a patch that mitigates the vulnerability but there is no indication that Sanchez has verified the efficacy of the patch.

ICS-CERT reports that the vulnerability is remotely exploitable via a social engineering attack. No exploit is publicly available for this specific system but there are publicly available exploits for this ‘attack vector’.

Fix Verification

Some people have asked me why I make a big deal out of announcing whether or not the researcher who discovered a vulnerability has verified the efficacy of the fix. After all, I am asked, isn’t it in the best interest of the vendor for the fix to work? Today a report from the Zero Day Initiative showed why it may be important for an outsider to verify fixes.

One of the key vulnerabilities exploited by Stuxnet was the now infamous Microsoft MS10-046 vulnerability. This vulnerability allowed systems to automatically run DLL files from USB devices without the operator initiating the action or even knowing that it took place. Microsoft patched that vulnerability four years ago. Earlier this year Michael Heerklotz reported that the patch did not work.

If Microsoft can convince themselves that a flawed patch mitigates a vulnerability then anyone can. A researcher that discovers a vulnerability looks at it in a different light than does a software engineer that is fixing it under a deadline. Two ways of looking at the problem may not actually be enough, but it is certainly better than just one way.

I’ll continue to be the gadfly that reports whether or not ICS-CERT is reporting that an outsider has verified the efficacy of the mitigation measure being reported.

ICS-CERT Publishes Two Advisories and an Update

Today the DHS ICS-CERT published two new advisories and updated a two week old advisory. The new advisories addressed vulnerabilities in control system applications from Schnedier and Magnetrol. The update was for the CodeWrights advisory.

CodeWrights Update

This update provides a slight expansion of the scope of the vulnerability. It explains that “the exploit is possible from any adjacent network between the FDT/DTM frame application and the HART transmitter on the 4 mA to 20 mA current loop”. The previous version noted only that access “to the 4 mA to 20 mA HART current loop is required to exploit this vulnerability”.

This slightly weakens the claim that crafting “a working exploit for this vulnerability would be difficult”.

Schneider Advisory

This advisory describes a stack-based buffer overflow vulnerability in a number of Schneider products. The original discover by Ariele Caltabiano (kimiya) with HP’s Zero Day Initiative (ZDI) dealt with the vulnerability in the SoMove Lite software package. Schneider subsequently discovered the same vulnerability in a number of device type managers (DTM) containing the same DLL. Schneider has produced a patch that mitigates the vulnerability, but there is no mention if kimiya has been given the opportunity to validate the effectiveness of the patch.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to execute arbitrary code on the affected systems. Schneider reports that the patch will replace the vulnerable FTD1 DLL.

Magnetrol Advisory

This advisory is kind of a waste of time. It describes the same CodeWrights vulnerability described in the advisory that was updated today. In fact, Magnetrol is one of the companies listed in the CodeWrights advisory as potentially having vulnerable HART DTM library is some of their products. The whole point of the CodeWrights advisory was that ICS-CERT could update that advisory when some vendor announced their implementation of a fix for the vulnerability in their equipment.

Oh well, Magnetrol has integrated the CodeWrights update and issued revised HART DTM library extensions.

BTW: ICS-CERT still has not mentioned the Siemens report of this vulnerability in some of their systems. I had expected them in the next (read this one) CodeWrights update to add Siemens to the list of affected vendors. I guess that I am just expecting too much from ICS-CERT.

I owe ICS-CERT a major public apology. The ‘missing’ Siemens vulnerability report deals with the NTP issue not the CodeWrights Vulnerability.

ICS-CERT Publishes 5 Advisories and 1 Update

It was a busy day for ICS-CERT today with four new advisories, an almost three month old advisory being publicly published and one update of an advisory that was published yesterday. Did anyone mention that S4x15 started today?

GE DNP3 Advisory

Let’s get the old advisory out of the way first. This advisory was originally published back on October 14^th on the US-CERT Secure Portal. It describes a Crain-Sistrunk improper input validation vulnerability in the DNP3 implementation used by GE iFix and Cimplicity products. The implementation was produced by Catapult Software who developed a patch that mitigates the vulnerability and GE has verified the efficacy of the patch. It does not appear that Crain-Sistrunk have verified the efficacy.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit this vulnerability to effect a DOS attack.

According to the Project Robus web site it now looks like 29 of the 30 DNP3 vulnerabilities reported by Crain-Sistrunk have now been publicly disclosed by ICS-CERT.

NOTE: There is no reason given for the unusually long delay between the US-CERT publication and the ICS-CERT public notification.

GE Multilink Advisory

This advisory describes two vulnerabilities that effect the GE Multilink line of switches. The vulnerabilities were found by Eireann Leverett of IOActive in one of the Multilink switch lines and GE notified ICS-CERT that other lines were affected as well. A firmware upgrade is available.

The two reported vulnerabilities are:

● Resource consumption vulnerability - CVE-2014-5418; and

● Hard-coded key - CVE-2014-5419

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to conduct a DOS attack or decrypt traffic. ICS-CERT reports that there is no public exploits for these specific vulnerabilities while GE restricts that claim specifically only to the ML800 switches.

Phoenix Contact Software Advisory

This advisory describes an authentication vulnerability in applications developed by Phoenix Contact Software. These applications are used by undisclosed vendors to run process control and manage IEC 61131 logic. The vulnerabilities were originally reported by Reid Wightman of Digital Bond. Phoenix Contact Software is considering developing a fix for these vulnerabilities.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit this vulnerability to inject arbitrary commands into the protocol.

The end use product may or may not contain mitigation measures to protect against this vulnerability.

GOOD LUCK. Caveat emptor.

Clorius Controls Advisory

This advisory describes an insecure Java client web authentication vulnerability in the Clorius Controls A/S ISC SCADA server. The vulnerability was originally reported by  Aditya Sood  who has validated the efficacy of the update that has been made available.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to gain complete access to the server.

Siemens Advisory

I noted the Siemens release of their advisory about this vulnerability this morning on Twitter and am now happy to report the ICS-CERT prompt release of their advisory. It describes three separate authentication vulnerabilities in the WinCC Sm@rtClient iOS Application. The vulnerabilities were originally reported by Kim Schlyter, Seyton Bradford, and Richard Warren from FortConsult. Siemens has produced an update to mitigate the vulnerability, but there is no report that the researchers have validated its efficacy.

The vulnerabilities include:

● Insufficiently protected credentials - CVE-2014-5231 and CVE-2014-5233; and

● Improper authentication - CVE-2014-5232

ICS-CERT reports that a relatively low skilled attacker with local access to the mobile device could exploit these vulnerabilities to gain access to the application and then presumably (my guess, not mentioned in the advisory) remotely access the control system with the full rights of the mobile device owner.

CodeWrights Advisory Update

Yesterday’s advisory was updated today to clarify that while ABB is a customer of CodeWrights HART DTM  library that they have not yet verified that any of their systems are affected by the identified vulnerability. The update provides a link to the ABB security advisory page where ABB will make the notification if any systems are found to be vulnerable.

I think that it is probably safe to assume that ICS-CERT has not yet verified that any other of the potentially affected vendors listed actually have products with the vulnerabilities. They apparently made the somewhat reasonable assumption that if these vendors (including ABB) had bought the rights to use the vulnerable libraries that there products using those libraries would be affected.

I guess we will just have to wait and see. I know which way I would bet.

ICS-CERT Extends Emerson Advisory

Today the DHS ICS-CERT published a new advisory for the vulnerability they reported in the Emerson HART DTM last week. The difference is that instead of just limiting the advisory to Emerson HART DTM they are extending it to all versions of the DTM that use the same DTM libraries produced by CodeWrights. Specifically they include HART systems from:

● ABB,

● Berthold Technologies,

● Emerson,

● Endress+Hauser,

● Magnetrol, and

● Pepperl+Fuchs.

As with the revised advisory published on Friday, ICS-CERT claims that there are no publicly available exploits of these vulnerabilities. CodeWrights has developed a new version of the library and Emerson has tested the library to validate its efficacy. No one has apparently asked the original researcher, Alexander Bolshev, to validate the new library efficacy.

At this point it seems that only Emerson has fixed the vulnerability in their use of the libraries. ICS-CERT states that it will update this advisory when additional reports of fixes have been provided. They also note that CodeWrights is only providing the updated libraries to ‘customers with current support agreements’. This would seem to suggest that other vendors with HART applications may be using the same affected libraries.