ICS-CERT Publishes Advisory and 2 Updates

Yesterday the DHS ICS-CERT published a control system security advisory for products from Philips. They also published updates for previous published advisory; one for control system products from Martem and one for medical device products from Philips.

Philips Advisory

This advisory describes 9 vulnerabilities in the Philips e-Alert Unit. The vulnerability is self-reported. Phillips has a version available that mitigates some of the vulnerabilities. A new version dealing with the remainder will be published by the end of the year.

The nine reported vulnerabilities are:

• Improper input validation - CVE-2018-8850;

• Improper neutralization of input during web page generation - CVE-2018-8846;

• Information exposure - CVE-2018-14803;

• Incorrect default permission - CVE-2018-8848;

• Cleartext transmission of sensitive information - CVE-2018-8842;

• Cross-site request forgery - CVE-2018-8844;

• Session fixation - CVE-2018-8852;

• Uncontrolled resource consumption - CVE-2018-8854; and

• Use of hard-coded credentials - CVE-2018-8856

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit some of the vulnerabilities to allow attackers to provide unexpected input into the application, execute arbitrary code, display unit information, or potentially cause e-Alert to crash. The other vulnerabilities could only be exploited from the same subnet.

Martem Update

This update provides new information on an advisory that was previously published on May 22^nd, 2018 and updated on May 24^th, 2018. The new information includes:

• An additional vulnerability (incorrect default permissions);

• An additional risk consequence (full control over RTU);

• Updated affected version information; and

• Mitigation information for new vulnerability

Philips Update

This update provides new information on an advisory that was originally published on August 21^st, 2018. The new information removes the ‘remotely exploitable’ language and notes that the “vulnerability is exploitable from within the same local device subnet”.

ICS-CERT Publishes 2 Advisories and an Update

Today the DHS ICS-CERT published a control system security advisory for products from Yokogawa and a medical device security advisory for products from Philips. They also updated a previously published control system advisory for products from GE. The Yokogawa vulnerability is one of the two that I briefly addressed on Saturday.

Yokogawa Advisory

This advisory describes a stack-based buffer overflow vulnerability in the Yokogawa iDefine, STARDOM, ASTPLANNER, and TriFellows. The vulnerability affects the licensing function of the products. The vulnerability is being self-reported. Yokogawa has updates available to mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow arbitrary code execution, or the stopping of the license management function.

Philips Advisory

This advisory describes an uncontrolled resource consumption vulnerability in the Philips  IntelliVue Information Center iX. An unidentified user notified Philips of the problem. Philips has identified work arounds and expects to provide an update in the 3^rd quarter, 2018.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit this vulnerability to effect a denial of service, the operating system will become unresponsive due to the network attack, which will affect the applications ability to meet the intended use.

GE Update

This update provides additional information on an advisory that was originally published on June 27^th, 2012. The update provides a link to the GE advisory that was last updated on February 22^nd, 2013. A document linked to in that advisory provides a more detailed description of the vulnerabilities and mitigation measures. That document was updated this weekend to correct broken links to the ICS-CERT; interestingly I cannot find any ICS-CERT links in either GE document.

ICS-CERT Updates AutomationDirect Advisory

Today the DHS ICS-CERT published an update for a control system security advisory for products from AutomationDirect. This update provides additional information on an advisory that was originally published on November 9^th, 2017 and updated on March 20^th, 2018. It adds a new product (DirectSOFT Programming Software) to the list of vulnerable products and provided mitigation links for that product.

NOTE: The link ICS-CERT provided in their TWITTER feed for this update does not work, but the link provided in their email notification does. And, of course, the link provided above works.

ICS-CERT Publishes 3 Advisories and 1 Update

Today the DHS ICS-CERT published three new control system security advisories for products from PEPPERL+FUCHS, WAGO and ABB. They also updated a previously published advisory for products from Rockwell.

PEPPERL+FUCHS Advisory

This advisory describes an improper authentication vulnerability in the PEPPERL+FUCHS VisuNet RM, VisuNet PC, Box Thin Client (BTC) families of products. The vulnerability was reported by Eyal Karni, Yaron Zinar, and Roman Blachman with Preempt Research Labs. PEPPERL+FUCHS has firmware updates for HMI running RM Shell 4 or RM Shell 5. For HMI running on Windows 7 or Windows 10 platforms the recommendation is to run the applicable Windows update for CVE-2018-0866. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker with uncharacterized access could exploit this vulnerability to intercept sensitive communications, establish a man-in-the-middle attack, achieve administrator privileges, and execute remote code.

NOTE: I initially reported on this vulnerability on July 7^th, 2018.

WAGO Advisory

This advisory describes three vulnerabilities in the WAGO e!DISPLAY Web-Based-Management. These vulnerabilities were reported by T. Weber of SEC Consult. The latest firmware version mitigates the vulnerabilities. There is no indication that Weber has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Cross-site scripting - CVE-2018-12981;

• Unrestricted upload of file with dangerous type - CVE-2018-12980; and

• Incorrect permission for critical resource - CVE-2018-12979

ICS-CERT reports that a relatively low-skilled attacker could use publicly available exploits to remotely exploit the vulnerabilities to execute code in the context of the user, execute code within the user’s browser, place malicious files within the filesystem, and replace existing files to allow privilege escalation.

NOTE: I initially reported on these vulnerabilities on July 14^th, 2018.

ABB Advisory

This advisory describes an improper input validation vulnerability in the ABB Panel Builder 800. The vulnerability was reported by Michael DePlante of Leahy Center and Michael Flanders of Trend Micro vis the Zero Day Initiative. ABB has provided work arounds pending further investigation of the vulnerabilities.

ICS-CERT reports that an uncharacterized attacker with uncharacterized access could conduct a social engineering attack to exploit this vulnerability to insert and run arbitrary code.

NOTE: I initially reported on these vulnerabilities on July 7^th, 2018.

Rockwell Update

This update provides new information on an advisory that was originally published on June 21^st 2018. The new information is an expansion of the affected versions for all affected products.

ICS-CERT Publishes an Advisory and an Update

Today the DHS ICS-CERT published a control system security advisory for products from Eaton. They also updated a medical device security advisory for products from Medtronic.

Eaton Advisory

This advisory describes a stack-based buffer overflow in the Eaton 9000X Drive. The vulnerability was reported by Ghirmay Desta working with the Zero Day Initiative. Eaton has an update available that mitigates the vulnerability. There is no indication that Desta was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker could remotely exploit the vulnerability to allow remote code execution.

Medtronic Update

This update provides additional information for an advisory that was originally published on May 17^th, 2018. The update adds a second vulnerability (Protection mechanism failure - CVE-2018-10631). This necessitated an increase of the CVSS (v3) ranking from 4.6 to 6.3 and an expanded risk evaluation section of the advisory.

ICS-CERT Publishes 1 Advisory and 1 Update for Medtronic Products

Today the DHS ICS-CERT published a medical device security advisory for products from Medtronic. They also updated a previously published medical device security advisory for products from the same company.

Medtronic Advisory

This advisory describes two vulnerabilities in the Medtronic MyCareLink Patient Monitor. The vulnerabilities were reported by Peter Morgan of Clever Security. Medtonic will be installing an automatic update to mitigate the vulnerabilities. There is no indication that Morgan has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Use of hard-coded password - CVE-2018-8870; and

• Exposed dangerous method or function - CVE-2018-8868

The Medtronic advisory makes a very important point about these vulnerabilities in particular that may include an important lesson to learn for all medical devices:

“Medtronic encourages patients to only use home monitors obtained directly from Medtronic or their clinician. Patients should not use a pre-owned MyCareLink Patient Monitor or one that is purchased secondhand or online. Monitors obtained through unofficial means are at an increased risk for exploitation associated with the vulnerabilities identified.”

ICS-CERT reports that an uncharacterized attacker with physical access to the monitor can exploit these vulnerabilities to allow privileged access to the monitor’s operating system.

Medtronic Update

This update provides new information on an advisory that was originally published on February 27^th, 2018. The update includes:

• A change in format of the advisory;

• New information in the ‘Risk Evaluation’ section (formerly the ‘Impact’ section);

• Removal of the second and third paragraphs from the old ‘Impact’ section;

• Addition of a new vulnerability (Improper restriction of communication channel to intended endpoints - CVE-2018-10596); and

• Addition of a new work around (disconnecting the programmer from the network).

The revised Medtronic advisory contains some information that does not entirely match up with the new information in ICS-CERT update. They note, for instance that: “After issuing this advisory on Feb. 27, 2018, Medtronic was made aware of additional vulnerabilities [emphasis added] in the CareLink 2090 Programmer and its accompanying software deployment network.” Since Medtronic does not name the ‘vulnerabilities’ it is possible that they have been lumped into the single vulnerability listed in the ICS-CERT report.

ICS-CERT Publishes Two Advisories and an Update

Today the DHS ICS-CERT published a control system security advisory for products from Siemens and a medical device security advisory for products from Naus Xltek. They also updated a control system security advisory for products from Siemens.

NOTE: There are still three Siemens advisories and two Siemens updates that were announced by Siemens on Tuesday that have not been covered by ICS-CERT. I will address those in my Saturday post.

Siemens Advisory

This advisory describes a permissions, privileges and access controls vulnerability in the Siemens SCALANCE X switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C. The vulnerability was reported by Dr. Ang Cui and Joseph Pantoga from Red Balloon Security. Siemens has provided updates for some of the affected products. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker on the same local network segment could exploit the vulnerability to execute arbitrary code.

Natus Xltek Advisory

This advisory describes 8 vulnerabilities in the Natus Xltek NeuroWorks software. The vulnerabilities were reported by Cory Duplantis from Cisco Talos. Natus Xltek has produced an update to mitigate the vulnerabilities. There is no indication that Duplantix has been provided an opportunity to verify the efficacy of the fix.

The eight reported vulnerabilities are:

• Out-of-bounds read (4) - CVE-2017-2852, CVE-2017-2858, CVE-2017-2860, and CVE-2017-2861; and

• Stack-based buffer overflow (4) - CVE-2017-2853, CVE-2017-2867, CVE-2017-2868, and CVE-2017-2869.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device being accessed; a buffer overflow condition may allow remote code execution.

Siemens Update

This update provides additional information on an advisory that was originally issued on November 8, 2016 and then updated November 22^nd, 2016; December 23^rd, 2016; February 14^th, 2017; March 2^nd, 2017,  May 9^th, 2017, June 20^th, 2017, and again on January 25^th, 2018. The update provided corrected affected version numbers and a link to a mitigation measure for PCS 7 V8.2.

ICS-CERT Publishes 2 Advisories and Updates 3 Siemens Advisories

Yesterday the DHS ICS-CERT published two control system security advisories for products from Siemens and Schneider. It also updated three control system security advisories for products from Siemens.

BTW: I discussed the Schneider advisory Saturday.

Siemens Advisory

This advisory describes two cross-site scripting vulnerabilities in the Siemens SCALANCE X switches. The vulnerabilities were reported by Marius Rothenbücher and Ali Abbas. Siemens has provided updates that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a highly-skilled attacker could remotely exploit the vulnerability to to store script code on the website and execute cross-site scripting (XSS), affecting the website’s confidentiality, integrity, and availability. The Siemens advisory notes that one of the vulnerabilities requires the attacker to log into the web application, but the other can be exploited via a social engineering attack.

Schneider Advisory

This advisory describes four vulnerabilities in the Schneider U.motion Builder. The vulnerabilities were reported by Wei Gao of Ixia and bigric3@360A-TEAM. Schneider has a firmware patch that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2018-7784;

• OS command injection - CVE-2018-7785;

• Cross-site scripting - CVE-2018-7786; and

• Improper input validation - CVE-2018-7787

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow for remote code execution.

SIMATIC Update

This update provides new information on an advisory that was originally published on February 14^th, 2017 and updated on June 15^th, on July 6^th and again on November 31^st, 2018. The update corrects the version affected data for PCS 7.

SIMATIC PCS7 Update

This update provides new information on an advisory that was originally published on November 2^nd, 2018. The update corrects the affected version data for PCS 7 v8.2 and provides information about the update available to mitigate the vulnerability.

SIMATIC WinCC Update

This update provides new information on an advisory that was originally published on March 29^th, 2018 and updated on April 24^th, 2018. The update corrects the affected version data for PCS 7 v8.2 and provides information about the update available to mitigate the vulnerability. In both this and the previous update, the new service pack for PCS 7 v8.2 is available from ‘local support’.

NOTE: Siemens announced a total of 5 new advisories and 5 updates yesterday. I expect that we will see the remainder Thursday.

ICS-CERT Publishes 2 Advisories and 3 Updates

Today the DHS ICS-CERT published a control system security advisory for products from Schneider Electric and a medical device security advisory for products from BeaconMedaes. They also published updates to previously published advisories for products from Rockwell, Siemens, and Martem.

Schneider Advisory

This advisory describes three vulnerabilities in the Schneider Floating License Manager. The vulnerabilities are being self-reported. Schneider has new versions available to mitigate the vulnerabilities.

The three reported vulnerabilities are:

• Heap-based buffer overflow - CVE-2016-2177;

• Improper restriction of operations within bounds of a memory buffer - CVE-2016-10395; and

• URL redirection to an untrusted site - CVE-2017-5571

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to cause a denial of service, allow arbitrary execution of code with system level privileges, or send users to arbitrary websites.

BeaconMedaes Advisory

This advisory describes three vulnerabilities in the BeaconMedaes TotalAlert Scroll Medical Air Systems web application. These vulnerabilities were reported by Maxim Rupp. BeaconMedaes has a new version that mitigates the vulnerability, There is no indication that Rupp has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Improper access control - CVE-2018-7526;

• Insufficiently protected credential - CVE-2018-7518; and

• Unprotected storage of credentials - CVE-2018-7515;

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities  to view and potentially modify some device information and web application setup information, which does not include access to patient health information.

NOTE: These vulnerabilities were not reported on the FDA Medical Device Safety Communication site.

Rockwell Update

This update provides new information on an advisory that was originally published on May 10^th, 2018. The new information is supposed to be a link to the Rockwell security advisory [log-in required]. Unfortunately, that link is to the Rockwell Arena advisory (the ICS-CERT advisory for that was publicly published on the same day as the Factory Talk advisory that is currently being updated here. The correct link is https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073133.

Siemens Update

This update provides new information on an advisory that was originally published on May 8^th, 2018. The new information is a revision to the instructions as to how owner/operators should go about getting the updated version. It removed the original link to the ‘hotfix’ and substitutes the instruction to “Obtain the update via the local Siemens representative”.

Martem Update

This update provides new information on an advisory that was originally published on May 22^nd, 2018. The new information is links to the Martem advisories for vulnerability CVE-2018-10603 and CVE-2018-10607. A link to the Martem advisory for the third vulnerability was already included in the initial ICS-CERT advisory.

ICS-CERT Publishes Advantech Advisory and Updates Siemens Advisory

Today the DHS ICS-CERT published a control system security advisory for products from Advantech. They also updated a previously issued advisory for products from Siemens.

Advantech Advisory

This advisory describes eleven vulnerabilities in the Advantech WebAccess products. The vulnerabilities were reported by Mat Powell and rgod, working with ZDI; Steven Seeley of Offensive Security, working with ZDI; and Donato Onofri and Simone Onofri of Business Integration Partners S.p.A. Advantech released a new version that mitigates the vulnerabilities. There is no indication that any of the researchers were provided an opportunity to verify the efficacy of the fix.

The eleven reported vulnerabilities are:

• SQL injection - CVE-2018-7501;

• Information exposure through directory listing - CVE-2018-10590;

• Improper authorization - CVE-2018-7505;

• Path traversal (2) - CVE-2018-7503, and CVE-2018-10589;

• Stack-based buffer overflow - CVE-2018-7499;

• Heap-based buffer overflow - CVE-2018-8845;

• Untrusted pointer dereference - CVE-2018-7497;

• External control of file name or path - CVE-2018-7495;

• Origin validation error - CVE-2018-10591; and

• Improper privilege management - CVE-2018-8841

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilitie to disclose sensitive information from the host and/or target, execute arbitrary code, or delete files.

Siemens Update

This update provides additional information for an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th, February 27^th, 2018 and most recently on May 3^rd, 2018. The new information includes links to new versions for version 4.7 of:

• SINAMICS G130;

• SINAMICS G150;

• SINAMICS S120; and

• SINAMICS S150

The Siemens security advisory provided undated version information for the same products, but that was not reported in the ICS-CERT advisory

NOTE: Siemens also reported two other updated advisories (here and here) and a new advisory (here) today when they reported this update. Hopefully ICS-CERT will publish their versions later this week.

ICS-CERT Publishes 3 Advisories and 1 Siemens Update

Today the DHS ICS-CERT published three control system security advisories for products from Rockwell Automation (2) and MatrikonOPC. The also updated a Siemens advisory; this is the update that I mentioned in passing last Thursday [changed link and day; 05-11-18, 0624 EDT]. The Factory Talk advisory was originally released to the HSIN ICS-CERT library on April 12, 2018.

Factory Talk Advisory

This advisory describes two vulnerabilities in the Rockwell Factory Talk Activation Manager. I described these vulnerabilities in a blog post on April 14^th. At that time I was not aware that ICS-CERT had published a restricted release advisory for the publicly available Rockwell notification (registration required). The ICS-CERT advisory does not mention the publicly available exploits for these vulnerabilities.

Arena Advisory

This advisory describes a use after free vulnerability in the Rockwell Arena simulation software for manufacturing. The vulnerability was reported by Ariele Caltabiano via the Zero Day Initiative. Rockwell has a newer version that mitigates the vulnerability. There is no indication that Caltabiano has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker with uncharacterized access could exploit this vulnerability to cause the software application to crash. The Rockwell notice explains that a social engineering attack would be required to get an authorized user to open a maliciously crafted Arena file to exploit this vulnerability.

MatrikonOPC Advisory

This advisory describes a files or directories accessible to external parties vulnerability in the MatrikonOPC Explorer. The vulnerability was reported by Ilya Kapov of Positive Technologies. MatrikonOPC has a patch available to mitigate the vulnerability. There is no indication that Kapov has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker with local access could exploit this vulnerability to transfer unauthorized files from the host system. The MatrikonOPC security notification reports that the vulnerability exists in the Microsoft MSXML libraries that have ‘known vulnerabilities’ but does not provide the version number being used. This raises the inevitable questions about whether or not all of the appropriate Microsoft patches have been applied. Again, this is an inevitable problem with the use of third party libraries.

Siemens Update

This update provides information on an advisory that was originally published on November 28th, 2017 and updated on April 5^th, 2018. This update provides mitigation measures for  SCALANCE M-800 and S615.

ICS-CERT Publishes 2 Advisories and 4 Updates

Yesterday the DHS ICS-CERT published a control system security advisory for products from Lantech. They also published a medical device security advisory for products from Philips. Additionally, they updated four previously published security advisories for products from Siemens (2), Nari, and Schneider.

Lantech Advisory

This advisory describes two vulnerabilities in the Lantech IDS 2102 Ethernet device server. The vulnerabilities were reported by Florian Adamsky. Lantech has not responded to ICS-CERT on these vulnerabilities.

The two reported vulnerabilities are:

• Improper input validation - CVE-2018-8869; and

• Stack-based buffer overflow - CVE-2018-8865

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to execute arbitrary code on the system through crafting malicious input.

Philips Advisory

This advisory describes three vulnerabilities in the Philips Brilliance CT Scanners. These vulnerabilities were self-reported. Philips has a new version that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Execution with unnecessary privilege - CVE-2018-8853;

• Exposure of resources to the wrong sphere - CVE-2018-8861; and

• Use of hard-coded credentials - CVE-2018-8857

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to execute software or to view/update files including patient health information (PHI), directories, or system configuration.

NOTE: These vulnerabilities were not reported on the FDA Medical Device Safety Communications web site.

PROFINET Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th,  November 28^th, 2017, January 18^th, 2018, January 25^th, 2018, January 27^th, 2018 and most recently on March 6^th, 2018. The new information includes updated version information and links to new versions for:

• SIMATIC CP 343-1 Std; and

• CP 343-1 Lean

Industrial Products Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th and most recently February 27^th, 2018. The new information includes updated version information and links to new versions for:

• SINAMICS G130;

• SINAMICS G150;

• SINAMICS S120; and

• SINAMICS S150

These two updates were published yesterday by Siemens. Siemens also announced three new advisories (here, here, and here) and one additional update (here). I suspect that ICS-CERT will publish their advisories and updates next week.

Nari Update

This update provides additional information on an advisory that was originally published on January 25^th, 2018. Nari has released a new version that mitigates the vulnerability. There is no indication that the researchers from Kaspersky labs that initially reported the vulnerability have been provided an opportunity to verify the efficacy of the fix. When ICS-CERT published their initial report they had received no response from Nari.

Schneider Update

This update provides additional information on an advisory that was originally published on April 17^th, 2018. The new information includes:

• Revises attacker characterization (now “high skill level”);

• Changed CVSS base score to 9.0 (from 10.0) and the CVSS vector string for vulnerability #1;

• Changed the CVSS vector string for vulnerability #2; and

• Completely re-wrote mitigations section to include links to Schneider advisory and ICS-CERT Yara rule

ICS-CERT Publishes 2 Advisories and Siemens Update

Yesterday the DHS ICS-CERT published two control system security advisories for products from Beckhoff and Siemens. They also updated a previously published advisory for products from Siemens. The two Siemens products were mentioned in a previous blog post.

Beckhoff Advisory

This advisory describes an untrusted pointer dereference vulnerability in the Beckhoff TwinCAT PLC products. The vulnerability was reported by Steven Seeley of Source Incite. According to the Beckhoff security advisory, the company has updates available that mitigate the vulnerability. There is no indication that Seeley has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to escalate privileges. ICS-CERT reports that Matlab modules need to be recompiled after updating.

Siemens Advisory

This advisory describes an improper access control vulnerability in the Siemens SIMATIC WinCC OA UI mobile app. The vulnerability was reported by Alexander Bolshev from IOActive, and Ivan Yushkevich from Embedi. Siemens has updates available that mitigate the vulnerability. There is no indication that the researchers have verified the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker on an adjacent network could exploit the vulnerability to read and write data from and to the app’s project cache folder. The Siemens security advisory notes that a social engineering attack is required to convince the App user to connect to an attacker-controlled WinCC OA server

Siemens Update

This update provides new information on an advisory that was originally published on January 25th, 2018 and updated on February 6^th. The update removes a product from the affected product list.

ICS-CERT Publishes 2 Advisories and 3 Updates

Yesterday the DHS ICS-CERT published two new control system advisories for products from Siemens and Geutebruck. It also updated three previously published control system advisories for products from Siemens (2) and AutomationDirect. ICS-CERT has missed some recent Siemens updates and an advisory.

Siemens Advisory

This advisory describes an improper input validation vulnerability in the Siemens SIMATIC, SINUMERIK, and PROFINET IO products. The vulnerability is being self-reported by Siemens. Siemens has provided updates that mitigate the vulnerability is some products and has provided generic workarounds for the remaining products while updates are developed for them.

ICS-CERT reports that an uncharacterized attacker on an adjacent network could exploit this vulnerability to execute a denial-of-service condition requiring a manual restart to recover the system. The Siemens security advisory notes that OSI Layer 2 access is required to exploit the vulnerability.

Geutebruck Advisory

This advisory describes six vulnerabilities in the Geutebruck IP cameras. The vulnerabilities were reported by Davy Douhine of RandoriSec and Nicolas Mattiocco of Greenlock. Geutebruck has a new firmware version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The six reported vulnerabilities are:

• Improper authentication - CVE-2018-7532;

• SQL injection - CVE-2018-7528;

• Cross-site request forgery - CVE-2018-7524;

• Improper access control - CVE-2018-7520;

• Server-side request forgery - CVE-2018-7516; and

• Cross-site scripting - CVE-2018-7512

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to lead to proxy network scans, access to a database, adding an unauthorized user to the system, full configuration download including passwords, and remote code execution.

SIMATIC Update

This update provides additional information on an advisory that was originally published on February 27^th, 2018. It provides updated version information and mitigation measures for:

• SIMATIC IPC547G: Update BIOS to R1.21.0

SIPROTEC Update

This update provides additional information on an advisory that was originally published on July 6^th, 2017, and updated on July 18^th, on July 28^th, on October 10^th, on November 30^th, and then again on January 4^th, 2018. It provides updated version information and mitigation measures for:

• SIPROTEC 7SJ66: All versions prior to V4.30

AutomationDirect Update

This update provides additional information on an advisory that was originally published on November 9^th, 2017. It adds a new product (Do-more Designer) to the list of vulnerable products and provided mitigation links for that product.

Missing Siemens Updates

Siemens has published updates and advisories that have not been covered in this latest series of ICS-CERT publications. Normally, I would not mention the ones from yesterday (two updates here and here, and a new advisory here), but today’s new Siemens advisory was also released yesterday. There is also an update from last week (here) that was not mentioned.

Two of the updates (here and here) are for the Spectre and Meltdown vulnerabilities in the Siemens Industrial products. ICS-CERT is unlikely to update their alert to reflect these new mitigation measures since the existing link to the Siemens advisory will take someone to the new information. This is a potential problem for anyone that is relying on ICS-CERT for information, but because of the way that ICS-CERT does their updates (and does not provide detailed change information) this appears to be unavoidable.

ICS-CERT Updates Meltdown Alert Again

Today the DHS ICS-CERT published the second update of their Meltdown Alert for this week. The update provides new information on the alert that was originally published on January 11^th, 2018 and updated on January 16^th, 2018, January 17^th, 2018, January 30^th, 2018, and on February 20^th, 2018.

The update provides links to three new vendor documents. They are:

• Beckman Coulter;

• Siemens (actually this link is good, but the one in the update does not work);

• Stryker (this is a direct link, the one in the update is a link to a link)

Both the Beckman and Stryker links take you to documents that were dated in January, so they are very preliminary notifications with little information. The Siemens document is dated today, and it provides some level of actionable detail for a number of industrial products.

NOTE: Siemens also released two other new security notifications this morning as well as updating six previously issued notifications. We may see these tomorrow on ICS-CERT, but more likely it will be next week.

ICS-CERT Publishes ABB Advisory and Updates Meltdown Alert

Today the DHS ICS-CERT published a new control system security advisory for products from ABB. They also provided an update of their previously issued alert for the Meltdown and Spectre vulnerabilities.

ABB Advisory

This update describes an information exposure vulnerability in the ABB netCADOPS Web Application. The vulnerability was reported by İsmail Erkek. ABB has provided product updates to mitigate the vulnerability. There is no indication that Erkek was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow critical information about the database to be exposed. The ABB security advisory clarifies that the attacker would have to have access to the control network hosting the DMS to exploit the vulnerability.

Meltdown Alert Update

This update provides additional information on an alert that was originally published on January 11^th, 2018 and updated on January 16^th, 2018, January 17^th, 2018 and on January 30^th, 2018. The update adds a link to a new vendor notification from Honeywell. Previously identified vendor pages for ABB and Schneider have been updated since the last ICS-CERT update. NOTE: The updated ABB page is the one I mentioned on Saturday.

ICS-CERT Publishes an Advisory and an Update

Today the DHS ICS-CERT published a medical device security advisory for products from Vyaire Medical. They also updated a control system security advisory for products from Siemens.

Vyaire Advisory

This advisory describes an uncontrolled search path element vulnerability in the Vyaire CareFusion Upgrade Utility. The vulnerability was reported by Mark Cross (@xerubus). Vyaire no longer supports the affected version and recommends that owners upgrade to the newer version of the utility. ICS-CERT notes that “This updated Upgrade Utility will not install on Windows XP and will require updating the underlying system to Windows 7 or later.” There is no indication that Cross was provided an opportunity to verify that the newer version is not affected.

ICS-CERT reports that an uncharacterized attacker with local access could exploit the vulnerability to insert a malicious DLL on the target system and run arbitrary code.

Siemens Update

This update provides additional information on an advisory that was originally published on January 25^th, 2018. The update removes a broken link that was included in the original Siemens security notice.

ICS-CERT Publishes 3 Advisories and 1 Update

Yesterday the DHS ICS-CERT published three control system security advisories for products from Gemalto, Smart Software Solutions (3S), and Fuji Electric. They also updated a previously published control system security advisory for products from NXP Semiconductor.

Gemalto Advisory

This advisory describes multiple vulnerabilities in the Gemalto Sentinel License Manager. The vulnerabilities were reported by Kaspersky Labs. The latest version of the software mitigates the vulnerability. There is no indication that Kaspersky Labs has been provided an opportunity to verify the efficacy of the fix.

The seven reported vulnerabilities are:

• Null pointer dereference - CVE-2017-11498;

• Stack-based buffer overflow (4) - CVE-2017-11497, CVE-2017-11496, CVE-2017-12818 and CVE-2017-12821;

• Heap-based buffer overflow - CVE-2017-12820; and

• Improper access control - CVE-2017-12822

NOTE: This is essentially the same vulnerability that I have discussed previously (here and here). The Kaspersky article on this problem actually list 14 vulnerabilities not the seven being reported here. I mentioned earlier that there may be as many as 40,000 products (not all being ICS, obviously) being affected by this issue. If the Gemalto dongle is clearly identified as being a ‘Sentinel License Manager’, then this advisory is clearly a much more effective means of addressing the issue rather than issuing advisories on each of the affected product lines. If the using vendors, however, have relabeled their dongles, then this advisory will not be effective in those cases. But that is not ICS-CERT’s fault.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities and that could lead to remote code execution or cause a denial-of-service condition, rendering the Sentinel LDK License Manager service unavailable (and the supported product also being unavailable).

3S Advisory

This advisory describes a stack-based buffer overflow in the 3S CODESYS Web Server. The vulnerability was reported by Zhu WenZhe of Istury IOT security lab. 3S has released a security patch to mitigate this vulnerability. There is no indication that Zhu was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability causing the device to crash, resulting in a buffer overflow condition that may allow remote code execution.

Fuji Advisory

This advisory describes a stack-based buffer overflow vulnerability in the Fuji V-Server VPR. The vulnerability was reported by Ariele Caltabiano (kimiya) via the Zero Day Intitiative. Fuji has produced a new firmware version that mitigates the vulnerability. There is no indication that Caltabiano has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability  to view sensitive information and disrupt the availability of the device.

NXP Update

This update provides new information for an advisory that was originally published on October 12^th, 2017. The update provides links to the new version of the single remaining product that was not previously fixed.

ICS-CERT Publishes 2 Advisories and Updates Meltdown Alert

Yesterday the DHS ICS-CERT published two control system security advisories for products from Siemens and Phoenix Contact. They also updated their control system alert for the Meltdown and Spectre chip vulnerabilities.

Siemens Advisory

This advisory describes multiple vulnerabilities in the Siemens TeleControl Server Basic monitoring platform. The vulnerabilities were apparently self-reported by Siemens. Siemens has produced a new version that mitigates the vulnerabilities. Siemens has also produced work arounds to reduce the risks.

The three reported vulnerabilities are:

• Authentication bypass using an alternate path or channel - CVE-2018-4835;

• Permissions, privileges and access controls - CVE-2018-4836; and

• Uncontrolled resource consumption - CVE-2018-4837

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow for escalation of privileges to perform administrative actions. The Siemens security advisory notes that an attacker would require authenticated network access to exploit these vulnerabilities.

NOTE: This is the advisory I mentioned last week.

Phoenix Advisory

This advisory describes an improper validation of integrity check value vulnerability in the Phoenix mGuard network devices. This vulnerability was apparently self-reported. Phoenix has developed firmware updates to mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to modify firmware update packages.

Meltdown Update

This update provides additional information on a control system alert that was originally published on January 11^th, 2018 and updated on January 16^th, 2018 and on January 17^th, 2018. The update provides links to new vendor reports for products from:

• Medtronic: http://www.medtronic.com/us-en/product-security/security-updates.html

The following previously published links to vendor sites contain new information:

• ABB – The updated page provides links to product specific information for System 800xA and  Symphony Plus;

• Medtronic – “no evidence suggests that Medtronic products are directly impacted”;

• Rockwell – linked document (log in required) provides updated Microsoft patch compatibility information;

• Schneider – Added Appendix A to security notification to provide product specific information;

ICS-CERT Publishes 2 Advisories and Updates 2 Siemens Advisories

Yesterday the DHS ICS-CERT published two control system security updates for products from Siemens and Advantech. They also updated to previously published advisories for products from Siemens.

Siemens Advisory

This advisory describes an improper input validation vulnerability in the Siemens Industrial Products. The vulnerability is self-reported. Siemens has provided several firmware updates to mitigate the vulnerability in many of the affected devices; work is ongoing for the remaining devices.

ICS-CERT reports that a relatively low-skilled attacker could remotely (with access to the local Ethernet segment) exploit the vulnerability to enter a denial-of-service condition, which may require human interaction to recover the system. The Siemens security advisory notes that: “Specially crafted PROFINET DCP broadcast packets could cause a Denial-of-Service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the systems. PROFIBUS interfaces are not affected.”

Advantech Advisory

This advisory describes two vulnerabilities in the Advantech WebAccess/SCADA platform. The vulnerability was reported by rgod via the Zero Day Initiative (ZDI). Advantech has released a new version to mitigate the vulnerability. There is no indication that rgod was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Path traversal - CVE-2018-5445; and

• SQL injection - CVE-2018-5443

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow sensitive information to be disclosed from the target or database without authentication.

Industrial Products Update

This update provides additional information on an advisory that was originally published on December 5th, 2017 and updated on 12-19-17. The update provides updated affected version information and mitigation links for:

• SINAMICS S110 w. PN: All versions prior to V4.4 SP3 HF6; and

• SINAMICS V90 w. PN: All versions prior to V1.02

PROFINET Update

This update provides additional information on an advisory that was was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, 2017, and most recently on November 14^th, 2017. The update provides updated affected version information and mitigation links for:

• SMART PC Access V2.3;

NOTE: Siemens announced this morning on TWITTER five new vulnerability updates and a new product vulnerability. It is going to be a long week.

Follow-up on Gemalto Vulnerabilities

Last week I made a comment in my post about the Siemens announced vulnerabilities in their implementation of the Gemalto Sentinel LDK RTE about multiple vendors probably being affected. Yesterday I saw an interesting article by Eduard Kovacs at SecurityWeek which lead to the Kaspersky report on the Gemalto vulnerabilities. Kaspersky is reporting 14 separate vulnerabilities in earlier versions of the Gemalto product, not just the two Siemens reported in their implementation. They also note that the vulnerable product may be in use by as many as 40,000 vendors world-wide including at least three additional ICS vendors; ABB, General Electric, and HP.

I hate to sound repetitive (but I will bang this drum as often as necessary), but software developers that use third party products have not only got to do a better job of vetting the security of those products, but they also have a moral (and probably legal) responsibility to update their own products (and notify their customers about the vulnerabilities) when vulnerabilities are discovered in 3^rd party components.

ICS-CERT also needs to consider expanding their vulnerability coordination role to try to reach out to additional vendors when these third-party vulnerabilities are reported. Now I realize that ICS-CERT does not generally know who uses what third-party components, but there are multiple ways that they could effectively reach out to large portions of the ICS vendor community. One would be to use a mailing list approach to send out private alerts to all ICS vendors with which they have coordinated vulnerabilities in the past. Another would be for those alerts to be made public on their web site.