ICS-CERT Publishes and Advisory and an Agenda

Thursday the DHS ICS-CERT published a new advisory for the Cogent Data Hub application and the final draft agenda for the Industrial Control System Joint Working Group’s (ICSJWG) Spring 2016 meeting.

Cogent Advisory

This advisory describes a privilege escalation vulnerability in the Cogent Data Hub application. The vulnerability was reported by Steven Seeley of Source Incite. Cogent has produced a new version of the software to mitigate the vulnerability and Steven has verified the efficacy of the fix.

ICS-CERT reports that an exploit of this vulnerability would require local access and would require an authorized user to load a malformed file. Given those prerequisites, ICS-CERT says that a relatively unskilled attacker could exploit this vulnerability to escalate their access to system level.

ICSJWG 2016 Spring Agenda

The final draft of the agenda ICSJWG 2016 Spring Meeting. As I had previously noted, this 3-day meeting will be held in Scottsdale, AZ starting May 3^rd, 2016. It looks like a nice mix of presentations in three simultaneous venues. The presentations on the Main stage include:

• How do you know if you are doing enough;

• Building C2M2 and its successful testing at several government and academic institutions;

• Factors that influence the structure of cyber organizations;

• Hands-on demonstration using pre-built wizards;

• NIST Cybersecurity Framework;

• Efforts to develop implementation guidelines in support of the NIST  Cybersecurity Framework;

• Meeting the challenge for cyber assurance with UL cap.

There is a forensics workshop that will be taking place the full three days of the Meeting. Each session will last about 30 minutes. “This hands-on technical workshop will allow attendees to learn recommended best practices for performing hard drive and memory captures on a

live system. Attendees will work one-on-one with ICSCERT’s Advanced Analytical Laboratory staff to learn techniques used to capture forensic copies for analysis.”

ICS-CERT Publishes 4 New Advisories

This morning the DHS ICS-CERT published four new control system security advisories for products from SMA Solar Technology, Moxa, Schneider Electric, and Cogent.

SMA Advisory

This advisory describes a hard-coded account vulnerability in the SMA Solar Technology Sunny WebBox product. The vulnerability was originally reported by Aleksandr Timorin of PT Security. SMA does not plan of fixing this vulnerability as the product will soon be discontinued. They have provided some mitigation measures but there is no indication that Timorin has been provided the opportunity to verify the efficacy of the fix. This advisory was originally released on the US CERT Secure Portal on June 30^th, 2015.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit this vulnerability to gain complete access to the system.

ICS-CERT reports that SMA “recommends using port-forwarding or a VPN to access these devices remotely”. ICS-CERT on the other hand recommends that owners remove and replace the system. The public portion of the SMA Solar Technology website contains no mention of this vulnerability.

It is disappointing to see any vendor stop providing security support for a product while it is still being sold even if it is an older system that is in the process of being phased out. Control system products are expected to have a longer useful life than a sales life. Failing to support such systems beyond sales is short sighted and provides a clear indication (IMHO) of a lack of customer focus on the part of the organization. CAVEAT EMPTOR!

Moxa Advisory

This advisory describes three separate vulnerabilities found in the Moxa EDS-405A/EDS-408A series managed Ethernet switches. The vulnerabilities were originally reported by Erwin Paternotte of Applied Risk. Moxa has produced a firmware update to mitigate the vulnerabilities but there is no indication that Paternotte has been given the opportunity to verify the efficacy of the fix.

The three vulnerabilities are:

∙ Improper privilege management, CVE-2015-6464;

∙ Resource exhaustion, CVE-2015-6465; and

∙ Cross-site scripting, CVE-2015-6466

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to elevate access privileges, execute a denial of service attack or inject JavaScript code.

The Moxa firmware release notes for the EDS-405A series does not list the cross-site scripting vulnerability among the fixes, but the release note for the EDS-408A series does. The other two vulnerabilities are listed in both release notes.

NOTE: There is an error in the click-through link to the Moxa update site in the ICS-CERT advisory, but the printed link does work.

Schneider Advisory

This advisory is a follow-up to the ICS-CERT alert published on August 12^th. The advisory describes two vulnerabilities on a number of PLC products that were disclosed (with proof of concept exploit code) at DefCon by Aditya K. Sood. ICS-CERT notes that the vulnerabilities had been previously disclosed to Schneider by Juan Francisco Bolivar. Schneider has released a firmware patch to mitigate the vulnerabilities, but there is no indication that either researcher has been provided and opportunity to verify the efficacy of the fixes.

ICS-CERT notes that it would be difficult to craft “a working exploit for these vulnerabilities” even though proof of concept exploit code is publicly available. This reflects the continuing opinion by ICS-CERT that crafting a social engineering attack is difficult. This does not appear (IMHO) to reflect recent history where even security conscious organizations have been successfully attacked by social engineering exploits.

The Schneider security notification also addresses the hard-coded credential vulnerability that was reported in the ICS-Alert (but was not mentioned in this advisory). The Schneider document notes that this vulnerability was previously addressed and provides a link to a recently updated security notification discussing the problem that was reported by Ruben Santamarta in 2011. That document continues to claim that the hard-coded credential is part of a deliberate design decision and Schneider is still considering whether or not it needs to be removed.

There is an interesting additional link to a Schneider document in the ICS-CERT mitigation section of the Advisory. It is a link to the Schneider report on the use of the TOFINO Firewall as a mitigation measure for PLC vulnerabilities. This is a very detailed (55 page) description of how to use this device.

Cogent Advisory

This advisory describes a code injection vulnerability in the Cogent DataHub application. The vulnerability was originally reported by an anonymous researcher via the HP Zero Day Initiative. Cogent has produced a new version that mitigates the vulnerability, but there is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to turn on an insecure processing mode in the web server.

ICS-CERT Publishes Three New Advisories

Today the DHS ICS-CERT published three new control system advisories affecting control system products from Advantech, Cogent and Siemens.

Advantech Advisory

This advisory reports on 5 different vulnerabilities in the Advantech WebAccess application. The vulnerabilities were reported by Dave Weinstein, Tom Gallagher, John Leitch, and others via the Zero Day Initiative (ZDI, but not currently listed on their ‘published advisories’ page). ICS-CERT notes that a new version of the application is available that corrects the problems but there is no indication that the reporting researchers have been given a chance to verify the efficacy of the mitigation efforts.

The vulnerabilities include:

• Stack-based buffer overflows (11 separate instances), CVE-2014-2364;

• Remote code execution, CVE-2014-2365;

• Password disclosure, CVE-2014-2366;

• Remote authentication bypass, CVE-2014-2367

• Unsafe ActiveX control marked safe for scripting, CVE-2014-2368

ICS-CERT reports that a moderately skilled attacker could use the publicly available exploits for these vulnerabilities to execute arbitrary code on the system. The advisory notes that the new version 7.2 corrects these deficiencies. The WebAccess site reports that the v7.2 available for download is ‘Trial Software’ and still has v7.1 available for free download without mention of these vulnerabilities.

Cogent Advisory

This advisory reports a code injection vulnerability in the Cogent DataHub application. The vulnerability was reported by John Leitch via ZDI (but again not currently listed there). A new version of DataHub is available that reportedly corrects these vulnerabilities, but there is no indication that Leitch has had an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively unskilled attacker could use the publicly available exploit to remotely execute arbitrary code.

In addition to making an updated version available for download, Cogent advises that an owner/operator could mitigate the vulnerability by:

• Disabling the web server component in their Cogent DataHub installation, or

• Configuring their network security to block access to the Cogent DataHub web server from untrusted locations.

Siemens Advisory

This advisory reports four vulnerabilities that relate to the OpenSSL software used by previously unreported Siemens applications. These vulnerabilities were self-reported by Siemens. Upgrades are available for some of the applications and Siemens has provided alternative mitigation measures for the others.

ICS-CERT reports that the four vulnerabilities include:

• A man-in-the-middle vulnerability, CVE-2014-0224; and

• Three separate improper input validation vulnerabilities, CVE-2014-0198, CVE-2010-5298, and CVE-2014-3470

NOTE: All of these CVE are existing OpenSSL vulnerability reports

The Siemens ProductCERT advisory reports that the updated versions of APE 2.0.2 and WinCC OA (PVSS) 3.12-P009 are available. Updates for the below listed products are being prepared, but the advisory provides alternative mitigation measures to be used in the interim.

• ROX 1: all versions (only affected if Crossbow is installed)

• ROX 2: all versions (only affected if eLAN or Crossbow is installed)

• S7-1500: all versions

• CP1543-1: all versions

ICS-CERT Publishes to New Advisories

Today the DHS ICS-CERT published new advisories for products from Cogent and Triangle MicroWorks (TMW). Both advisories are based upon coordinated disclosures.

Cogent Advisory

This advisory addresses multiple vulnerabilities in the Cogent DataHub. The vulnerabilities were reported by Alain Homewood. Cogent has produced a new version of the application that addresses three of the four identified vulnerabilities and ICS-CERT reports that Homewood has verified the efficacy of the mitigation measures for those vulnerabilities.

The vulnerabilities are:

• Reflected cross-site scripting, CVE-2014-72038;

• Directory traversal, CVE-2014-59156;

• Password hash with insufficient computational effort, CVE-2014-32537; and

• Many known vulnerabilities in OpenSSL version 1.0.0D.

ICS-CERT reports that a low to moderately skilled attacker could exploit these vulnerabilities (three of them remotely) with a variety of potential effects. The new version does not address the third vulnerability listed above; Cogent advises that they do not plan to address this vulnerability due to “compatibility issues with existing systems”. They explain (and Homewood agrees according to the advisory) that an adequately strong password will be an effective mitigation of this vulnerability.

Triangle MicroWorks Advisory

This advisory addresses Crain-Sistrunk DNP3 vulnerabilities in TMW SCADA Data Gateway. It addresses the two standard vulnerabilities in serial and IP communications. In fact the wording of this advisory is nearly identical with an ICS-CERT advisory published last fall that covered both the devices included in this advisory as well as TMW’s DNP3 Source Code libraries.

Interestingly this advisory points us at a TMW document that documents the changes that are referenced in this advisory. Unfortunately, that document only reports the changes that were made last fall in response to the earlier advisory. Something odd is going on here and what it is isn’t clear from the ICS-CERT advisory. 

BTW: The Project Robus web page does not yet list this second TMW advisory. Looking at their tally it would seem that we still have seven more Crain-Sistrunk advisories to be published by ICS-CERT.