ICS-CERT Publishes 2 Advisories and 4 Updates

Yesterday the DHS ICS-CERT published a control system security advisory for products from Lantech. They also published a medical device security advisory for products from Philips. Additionally, they updated four previously published security advisories for products from Siemens (2), Nari, and Schneider.

Lantech Advisory

This advisory describes two vulnerabilities in the Lantech IDS 2102 Ethernet device server. The vulnerabilities were reported by Florian Adamsky. Lantech has not responded to ICS-CERT on these vulnerabilities.

The two reported vulnerabilities are:

• Improper input validation - CVE-2018-8869; and

• Stack-based buffer overflow - CVE-2018-8865

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to execute arbitrary code on the system through crafting malicious input.

Philips Advisory

This advisory describes three vulnerabilities in the Philips Brilliance CT Scanners. These vulnerabilities were self-reported. Philips has a new version that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Execution with unnecessary privilege - CVE-2018-8853;

• Exposure of resources to the wrong sphere - CVE-2018-8861; and

• Use of hard-coded credentials - CVE-2018-8857

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to execute software or to view/update files including patient health information (PHI), directories, or system configuration.

NOTE: These vulnerabilities were not reported on the FDA Medical Device Safety Communications web site.

PROFINET Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th,  November 28^th, 2017, January 18^th, 2018, January 25^th, 2018, January 27^th, 2018 and most recently on March 6^th, 2018. The new information includes updated version information and links to new versions for:

• SIMATIC CP 343-1 Std; and

• CP 343-1 Lean

Industrial Products Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th and most recently February 27^th, 2018. The new information includes updated version information and links to new versions for:

• SINAMICS G130;

• SINAMICS G150;

• SINAMICS S120; and

• SINAMICS S150

These two updates were published yesterday by Siemens. Siemens also announced three new advisories (here, here, and here) and one additional update (here). I suspect that ICS-CERT will publish their advisories and updates next week.

Nari Update

This update provides additional information on an advisory that was originally published on January 25^th, 2018. Nari has released a new version that mitigates the vulnerability. There is no indication that the researchers from Kaspersky labs that initially reported the vulnerability have been provided an opportunity to verify the efficacy of the fix. When ICS-CERT published their initial report they had received no response from Nari.

Schneider Update

This update provides additional information on an advisory that was originally published on April 17^th, 2018. The new information includes:

• Revises attacker characterization (now “high skill level”);

• Changed CVSS base score to 9.0 (from 10.0) and the CVSS vector string for vulnerability #1;

• Changed the CVSS vector string for vulnerability #2; and

• Completely re-wrote mitigations section to include links to Schneider advisory and ICS-CERT Yara rule

ICS-CERT Publishes Two Advisories

Today the DHS ISC-CERT published two control system security advisories for products from Siemens and Moxa.

Siemens Advisory

This advisory describes multiple vulnerabilities in Siemens SICAM RTU products. The vulnerabilities were reported by SEC Consult Vulnerability Lab. Siemens is recommending that the web server be disabled after system commissioning to mitigate the vulnerabilities in current versions.

The three vulnerabilities reported are:

• Missing authentication for critical function - CVE-2017-12737;

• Improper neutralization of input during web page generation - CVE-2017-12738; and

• Improper control of generation of code - CVE-2017-12739

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability using a publicly available exploit to execute arbitrary code. The Siemens security advisory notes that network access to the affected devices is required.

Moxa Advisory

This advisory describes multiple vulnerabilities in the Moxa NPort serial network interface products. The vulnerabilities were reported by Florian Adamsky. Moxa has a new firmware version that mitigates the vulnerability. There is no indication that Adamsky has been provided an opportunity to verify the efficacy of the fix.

The three vulnerabilities reported are:

• Improper neutralization of special elements in output used by downstream component - CVE-2017-16719;

• Information exposure - CVE-2017-16715; and

• Uncontrolled resource consumption - CVE-2017-14028

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow for remote code execution on the device.