Public ICS Vulnerability Disclosures – Week of 03-04-17

This week there were two control system vulnerability disclosures on the Full Disclosure web site. The first is for an access control platform and the second is for a laboratory information management system (LIMS) used in medical labs.

Access Control Platform

On Wednesday Andrew Griffiths from the Google Security Team announced multiple vulnerabilities in the Spider access control platform from SICUNET. The vulnerabilities include:

• Outdated software;

• PHP include();

• Unauthenticated remote code execution;

• Hardcoded root credentials; and

• Passwords stored in plaintext

As expected from the Google Security Team, the vendor was notified of the vulnerabilities multiple times, but no reply was received within the standard 90-day disclosure window used by Google.

DNA LIMS

On Thursday Nicholas von Pechmann from Shorebreak Security announced multiple vulnerabilities in the dnaLIMS application from dnaTools. The vulnerabilities include:

• Improperly protected web shell - CVE-2017-6526;

• Unauthenticated Directory Traversal - CVE-2017-6527;

• Insecure Password Storage - CVE-2017-6528;

• Session Hijacking - CVE-2017-6529;

• Cross-site Scripting (2 instances); and

• Improperly Protected Content

The Shorebreak Security Advisory provides proof of concept code for most of these vulnerabilities and reports that they have developed Metasploit modules for many of them.

Shorebreak notified the vendor in November of the vulnerabilities. While dnaTools replied that the application should be kept behind a firewall, there was no indication given to the researchers that there would be any attempt to fix the vulnerabilities. Multiple university laboratories have on-line login pages for this application that are readily found via Google.

ICS-CERT Publishes NTP Advisory

This morning the DHS ICS-CERT published an advisory concerning multiple vulnerabilities in the Network Time Protocol (NTP) reported by Neel Mehta and Stephen Roettger from the Google Security Team. A newer version of the protocol (NTP-4.2.8) is not affected by these vulnerabilities. The identified vulnerabilities include:

• Insufficient entropy - CVE-2014-9293;

• Use of cryptographically weak PNRG - CVE-2014-9294;

• Stack based buffer overflows - CVE-2014-9295; and

• Missing return on error - CVE-2014-9296

According to the NTP.org security notice on these vulnerabilities there are actually three different buffer stack overflows covered in the reported CVE: in crypto_recv(), in ctl_putdata(), and configure().

ICS-CERT reports that a relatively unskilled attacker could use the publicly available exploits to execute malicious code. They also report that “NTP is widely used within operational Industrial Control Systems deployments”.

The CERT-CC vulnerability notice for these vulnerabilities is starting to list various vendors and their status vis a vi these vulnerabilities. Unfortunately there are no purely ICS vendors currently on their list. It would be nice if ICS-CERT attempted to do the same specifically for control system vendors.