ICS-CERT Publishes 4 Advisories and One ABB Update

Today the DHS ICS-CERT published four new control system security advisories for products from Schneider Electric (2), GE and Nortek. Additionally, they provided an update for a previously published advisory for products from ABB.

StructureOn Advisory

This advisory describes an unrestricted upload of file with dangerous type vulnerability in the Schneider StruxureOn Gateway software management program. The vulnerability is being self-reported.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to upload a malicious file to any directory on the device, which could lead to remote code execution. The Schneider security advisory reports that the file must be a .zip file with specifically modified metadata for this vulnerability to be exploited.

IGSS Mobile Advisory

This advisory describes two vulnerabilities in the Schneider IGSS Mobile application (iOS and Android). The vulnerabilities were reported by Alexander Bolshev (IOActive) and Ivan Yushkevich (Embedi). Schneider has produced updates for both versions. There is no indication that either researcher has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper certificate validation - CVE-2017-9968; and

• Plaintext storage of password - CVE-2017-9969

ICS-CERT reports that a relatively low-skilled attacker with local access (okay they, actually said: “Locally exploitable”; that may not mean ‘local access’) could exploit the vulnerability to execute a man-in-the-middle attack. In addition, passwords can be accessed by unauthorized users.

NOTE: Marc Ayala pointed out to me that anyone can download these apps from the appropriate (iOs/Android) app store. This means that it would be easy to exploit a compromised mobile password. All the attacker needs to do is to get access to the IGSS configuration file on an oh so secure smart phone to compromise the password.

GE Advisory

This advisory describes two vulnerabilities in the GE D60 Line Distance Relay. The vulnerabilities were reported by Kirill Nesterov of Kaspersky Labs. GE has released new firmware that mitigates the vulnerability. There is no indication that Nesterov was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2018-5475; and

• Improper restriction of operations within bounds of memory buffer - CVE-2018-5473

ICS-CERT reports that relatively low-skilled attacker could remotely exploit the vulnerability to execute arbitrary code on the device.

Nortek Advisory

This advisory describes a command injection vulnerability in the Nortek Linear eMerge E3 Series access control interface. The vulnerability was reported by Evgeny Ermakov and Sergey Gordeychik. Nortek recommends upgrading the system using established procedures. There is no indication that either researcher was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability  to execute malicious code on the system with elevated privileges, allowing for full control of the server.

ABB Update

This update provides additional information on an advisory that was originally published on November 14^th, 2017. The update reports that the new update of Mesh OS mitigates the KRACK vulnerability in these devices.

NOTE: The updated ABB security advisory that forms the basis for this ICS-CERT update was published on January 11^th, 2018.

ICS-CERT Publishes 3 Emerson Advisories

Today the DHS ICS-CERT published three control system security advisories for three products from Emerson. I’m also reporting an update for a previously published advisory for a product from Schneider; the update was published last week.

DeltaV Wireless I/O Card Advisory

This advisory describes an open SSH port vulnerability in the Emerson DeltaV Wireless I/O Card. The vulnerability is apparently self-reported. Emerson has produced a firmware update to mitigate the vulnerability.

ICS-CERT reports that it would be difficult to develop a working exploit of this vulnerability, but it could be remotely exploited to access the file system of devices using the affected product.

DeltaV Easy Security Management Advisory

This advisory describes an improper privilege management vulnerability in the Emerson DeltaV Easy Security Management application. Apparently, this is a self-reported vulnerability. Emerson is discontinuing support for this application.

ICS-CERT reports that local network access is required to exploit this vulnerability, but that constructing an exploit would be difficult. A successful exploit would allow an attacker to elevate privileges within a DeltaV control system.

Liebert SiteScan Advisory

This advisory describes an XML external entity vulnerability in the Emerson Liebert SiteScan application. The vulnerability was reported by Evgeny Ermakov from Positive Technologies. Emerson has produced patches to mitigate the vulnerability.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability, which may lead to the disclosure of confidential data, denial of service (DoS), server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

Schneider Update

This update provides additional information about what versions affected by these vulnerabilities require a re-boot to recover from the denial of service. It also provides a link to the Schneider security notice that I mentioned.

BTW: Last Friday Siemens Tweeted about a new advisory and an update of another advisory. I had been expecting those to be reported by ICS-CERT today. Because of the holiday I did not notice them until yesterday.