Three Advisories Published – 01-17-19

Today the DHS NCCIC-ICS published three control system security advisories for products from ControlByWeb, ABB and Omron.

ControlByWeb Advisory

This advisory describes two vulnerabilities in the ControlByWeb X-320M web-enabled weather station. The vulnerabilities were reported by John Elder and Tom Westenberg of Applied Risk. ControlByWeb has a firmware update that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper authentication - CVE-2018-18881; and

• Cross-site scripting - CVE-2018-18882

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow arbitrary code execution and could cause the device being accessed to require a physical factory reset to restore the device to an operational state.

ABB Advisory

This advisory describes an improper input validation vulnerability in the ABB CP400 Panel Builder TextEditor. The vulnerability was reported by Ivan Sanchez of NullCode. ABB has a new version that mitigates the vulnerability. There is no indication that Sanchez has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to allow an attacker to execute arbitrary code and cause a denial-of-service condition within the Text Editor application. The ABB security advisory reports that a social engineering attack would be required to get an operator to load a specially crafted file.

NOTE: I briefly discussed this vulnerability back in early December.

Omron Advisory

This advisory describes five vulnerabilities in the Omron CX-Supervisor. The vulnerabilities were reported by Esteban Ruiz (mr_me) of Source Incite via the Zero Day Initiative. Omron has a new version that mitigates the vulnerabilities. There is no indication that Ruiz has been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Code injection - CVE-2018-19011;

• Command injection (2) - CVE-2018-19013 and CVE-2018-19015;

• Use after free - CVE-2018-19017; and

• Type confusion - CVE-2018-19019

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to cause a denial-of-service condition, and/or allow an attacker to achieve code execution with privileges within the context of the application.

NOTE: The Omron release notes for the new version recommended in this NCCIC-ICS advisory lists 8 ZDI reported vulnerabilities (no details currently available on ZDI site) corrected and a couple of other cybersecurity improvements that are included.

Public ICS Disclosure – Week of 11-24-18

This week we have three vendor disclosures from Schneider Electric, ABB and Siemens, exploit code for a previously disclosed vulnerability and a disclosure from a researcher which is probably been coordinated with Moxa. And there is a special non-disclosure disclosure at the end of the post.

Schneider Advisory

This advisory describes five vulnerabilities in the Schneider Embedded Web Servers for Modicon V1.1 PLC’s. The vulnerabilities were reported by Tenable. Schneider has provided generic fixes to mitigate the vulnerability. There is no indication that Tenable has been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Unverified password change (2) - CVE-2018-7811 and CVE-2018-7809;

• Cross-site scripting - CVE-2018-7810;

• Basic XSS - CVE-2018-7831; and

• HTTP response splitting - CVE-2018-7830

ABB Advisory

This advisory describes an improper input validation vulnerability in the ABB CP400 Panel Builder TextEditor 2.0. The vulnerability was reported by Ivan Sanchez from Nullcode Team. ABB has an updated version of the affected products to mitigate the vulnerability. ABB reports that Sanchez has verified the efficacy of the fix.

Siemens Advisory

This advisory describes 21 vulnerabilities in GNU/Linux subsystem of

the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP. The vulnerabilities were reported by an unidentified ‘external source’. Siemens reports that the vulnerabilities will be corrected in the next firmware version and currently provides generic mitigation advice.

The advisory provides links to 21 CVE’s without a description of the associated vulnerability or risk evaluation of the vulnerability in the affected system. I have clicked through on a couple of these links to the Debian.org reports on the vulnerabilities and there are a wide variety of vulnerabilities involved here with reports of public exploits for many of them. Those exploits are not specifically for the Siemens implementation of these processes, but a reasonably competent hacker could probably use them to craft a Siemens specific exploit.

NOTE: Insert standard blurb about 3^rd party vulnerabilities potentially being found in products from other vendors. Fortunately (sarcasm warning) Linux is a rather obscure OS and is seldom seen in real operations. (SIGH)

Schneider Exploit

PHOTUBIAS published an exploit for a session calculation authentication bypass vulnerability in the Schneider Modicon PLCs. This vulnerability was previously reported by ICS-CERT.

NOTE: Exploit-DB.com has ‘updated’ the layout of their site. Larger print in headers, more colorful, but unfortunately harder to read. Too bad.

Moxa Vulnerabilities

Maxim Khazov reports two OS command injection vulnerabilities in the Moxa NPort W2x50A wireless device servers. The report includes proof of concept exploit instructions. Khazov reports that Moxa has fixed these vulnerabilities in a newer version, but it is not clear if this is a coordinated disclosure.

Bonus Non-Disclosure Disclosure

This week OSIsoft released a new version of PI Integrator for Business Analytics. In the release notes (pg 12) OSIsoft notes that:

“For this release of the PI Integrator for Business Analytics, one security vulnerability was identified and fixed. The resolved issue was rated using the Common Vulnerability Scoring System (CVSS).”

The only other information provided was that the CVSS score was rated as low (0.1 to 3.9).

Now I have a lot of respect for OSIsoft’s commitment to security and I am a big fan of their PI Processbook application, but the way OSIsoft has handled this non-disclosure is disappointing. It is great that they have fixed this unidentified, low-risk security vulnerability, but they have provided no security incentive to owners of this product to upgrade to this new version. The other fixes enumerated in the release notes may provide adequate incentive to upgrade, but if folks have not had problems with those listed issues, a defined security problem might make a difference.

BTW: I really hate it when people set security on .PDF documents so that they will not allow cutting and pasting from the documents. Really? I like to make sure that when I quote a document, I do it accurately. Cutting and pasting is the easiest, most efficient way of doing that. Re-typing just sets me up for making errors. And, the quote is still there.

ICS-CERT Publishes 2 Rockwell Advisories and Year-in-Review

Today the DHS ICS-CERT published two control system security advisories for products from Rockwell Automation; both had previously been published on the limited access NCCIC Portal on January 16^th, 2017. They also published their annual report on ICS-CERT activities for 2016.

Factory Talk Advisory

This advisory describes an unquoted search path or element vulnerability in the Rockwell Factory Talk Services Platform. This is a self-reported vulnerability. Rockwell has produced a new version that mitigates the vulnerability.

ICS-CERT reports that an authenticated, but nonprivileged, local user could exploit this vulnerability to link to or run a malicious executable.

Connected Components Workbench Advisory

This advisory describes a DLL hijack vulnerability in the Rockwell Connected Components Workbench. The vulnerability was reported by Ivan Sanchez. Rockwell has produced a new version that mitigates the vulnerability. There is no indication that Sanchez has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT makes no mention of the exploitability of this vulnerability, but do note that a successful exploit could result in effects ranging from a denial of service (DoS) to the injection of malicious code into trusted processes, depending on the content of the DLL and the risk mitigations in place by the victim.

2016 Year in Review

The annual report is much the same as we saw last year in the 2015 report; it is essentially the same as a annual report that one might expect to find sent out to existing and prospective stock holders of a fortune 500 company. There are lots of numbers, pretty pictures and written fluff that provides little or no new information that can really be used by anyone in the control system security field.

For example, on page 8 there is a brief discussion of incident response activities in FY 2016. After detailing that ICS-CERT responded to 290 incidents, they toss off the comment that: “Also in FY 2016, the team responded to the first known cyberattack to result in physical impact to a power grid.” No additional information was provided, but I suspect that this was the December 2015 attack on the grid in Georgia, not a US grid attack. But you cannot tell that from this report.

ICS-CERT Publishes 3 Advisories

This morning the DHS ICS-CERT published three advisories for control system components from Rockwell, Eaton Lighting Systems and Pro-Face. Two of the three advisories had previously been released on the US CERT Secure Portal.

Rockwell Advisory

This advisory describes an access violation memory error in the Rockwell Automation Integrated Architecture Builder (IAB) application. The vulnerability was reported by Ivan Sanchez from Nullcode Team. Rockwell has produced a software update to mitigate the vulnerability, but there is no indication that Sanchez has been afforded the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a social engineering attack is required to get an authorized user to load to introduce or change project files and then access the malformed file. ICS-CERT does not count such social engineering attacks as being remotely executable.

The advisory includes a number of additional mitigation measures that Rockwell recommends that owners implement when using the IAB application.

Eaton Lighting Systems Advisory

This advisory describes twin vulnerabilities in the Eaton Lighting Systems EG2 Web Control application. The vulnerabilities were reported by Maxim Rupp. Eaton has produced a firmware patch to mitigate the vulnerability, but there is no indication that Rupp has been provided an opportunity to verify the efficacy of the fix.

The two vulnerabilities were:

• Reliance on cookies without validation and integrity checking - CVE-2016-2272; and

• Cleartext storage of sensitive information - CVE-2016-0871

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to configure the system.

ICS-CERT reports that though a firmware patch has been made available, that Eaton will be moving this product to end of life later this year and recommends that owners upgrade to the new system. It is nice to see that the patch was developed anyway.

Pro-face Advisory

This advisory describes four vulnerabilities in the Pro-face GP-Pro EX HMI software. The vulnerabilities were reported by ZDI (the first three) and Jeremy Brown. Pro-face has produced an update module to mitigate the vulnerabilities, but there is no indication that the researchers were afforded to the opportunity to verify the efficacy of the fix.

The vulnerabilities include:

• Heap-based buffer overflow - CVE-2015-2290;

• Out-of-bounds read - CVE-2015-2291;

• Stack-based buffer overflow - CVE-2015-2292; and

• Use of hard-coded credentials - CVE-2015-7921

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to execute arbitrary code.

It is odd that a Schneider Electric company would not publish a security advisory for four vulnerabilities, two of which are fairly serious.

ICS-CERT Updates Advisory and Publishes New Advisory

This morning the DHS ICS-CERT published an update for an advisory published in December for a cross-site scripting vulnerability in the in XZERES 442SR turbine generator operating system (OS). It also published a new advisory for a vulnerability in the ABB Panel Builder 800.

XZERES Update

This update corrects the CVE number for the vulnerability. The CVE number published in the original advisory was actually for another cross-site scripting vulnerability in the same equipment that was reported by ICS-CERT in an advisory published in March of last year.

ABB Advisory

This advisory describes a DLL hijacking vulnerability in the ABB Panel Builder 800. The vulnerability was reported by Ivan Sanchez from Nullcode Team. ABB has produced a new version of the software that mitigates the vulnerability. There is no indication that Sanchez has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an attacker must get malicious code to a specific directory in the file system and then convince an authorized operator to execute the code. ICS-CERT says that this cannot be exploited remotely.

The ABB Security Advisory (not referenced in this advisory) for this vulnerability has a workaround that can be used pending the updating of the software to the newer version. Thanks to Joel Langill for tweeting about this document this morning.

ICS-CERT Publishes Advantech Advisory

This afternoon the DHS ICS-CERT published an advisory for the Advantech WebAccess application. The Advisory covers 15 vulnerabilities identified by a number of different researchers, including Ivan Sanchez. I think this sets an ICS-CERT record for the number of vulnerabilities is a single advisory. Advantech has produced a new version that mitigates the vulnerabilities and Sanchez has tested it to verify the efficacy of the fix for the unidentified vulnerabilities that he reported.

The vulnerabilities [corrected word 10:20 CST, 1-16-16] include:

• Access of memory location after end of buffer - CVE-2016-0851;

• Unrestricted upload of file with dangerous type - CVE-2016-0854;

• Path traversal - CVE-2016-0855;

• Stack-based buffer overflow - CVE-2016-0856;

• Heap-based buffer overflow - CVE-2016-0857;

• Race condition - CVE-2016-0858;

• Integer overflow to buffer overflow - CVE-2016-0859;

• Improper restriction of operations within bounds of a memory buffer - CVE-2016-0860;

• Improper access control - CVE-2016-0852;

• Improper input validation - CVE-2016-0853;

• Cross-site scripting - CVE-2016-0848;

• SQL injection - CVE-2016-0847;

• Cross-site request forgery - CVE-2016-0846;

• External control of file name or path - CVE-2016-0867; and

• Clear text storage of sensitive information - CVE-2016-08443;

ICS-CERT reports that a relatively unskilled attacker could remotely exploit these vulnerabilities.

There is nothing in the Advantech press release for this new version or the release notes that indicates that any security issues (much less 15 of them) exist and have been resolved. The description of some of the ‘resolved problems’ can be traced back to some of the vulnerabilities listed above by someone versed in cybersecurity vulnerabilities, but there is nothing in the Advantech literature that would indicate that there was any security need to switch to the new version

ICS-CERT Updates XZERES Advisory and Publishes 2 New Advisories

This afternoon the DHS ICS-CERT updated the XZERES advisory published earlier this week. It also published controls system advisories for products from Open Automation and Advantech.

XZERES Update

This update revises the description of the potential impact of the vulnerability. Originally it said that: “Successful exploitation of this vulnerability allows the ID to be retrieved from the browser and will allow the default ID to be changed.” Now it reads: “Successful exploitation of this vulnerability could allow the injection of malicious script.” That is a significant change in impact.

The description of the cross-site scripting vulnerability has also been changed. Originally it said: “The 442SR OS recognizes both the POST and GET methods for data input. By using the GET method, an attacker may retrieve the ID from the browser and will allow the default user ID to be changed. The default user has admin rights to the entire system.” It now reads: “The 442SR OS does not provide adequate input validation. This could allow malicious script to be injected into the program.” The CVSS v3 base score remains 9.8.

NOTE: This update is listed on the ICS-CERT landing page, but just because the original would still be there and the change was made to the original listing. I still recommend following @ICSCERT on TWITTER to get notified of these updates.

Open Automation Advisory

This advisory describes an uncontrolled search path element vulnerability in the Open Automation Software OPC Systems.NET application. The vulnerability was reported by Ivan Sanchez from Nullcode Team. ICS-CERT reports that Open Automation Software does not intend to patch the vulnerability at this time.

ICS-CERT reports that a social engineering attack is required to exploit this DLL hijacking vulnerability. A successful exploit would give the attacker access at the same privilege level as the application.

ICS-CERT reports that: “Open Automation Software has passed the researcher information to its support team to assist customers in the event that they encounter this vulnerability.”

Advantech Advisory

This advisory describes three vulnerabilities in the Advantech EKI-132x platform devices. This was an uncoordinated disclosure made by Tod Beardsley of Rapid7. Advantech plans to release updated firmware to fix these vulnerabilities by the end of this month.

The three vulnerabilities are:

• OS command injection (Shellshock) - CVE-2014-6271;

• Improper restriction of operations within the bounds of a memory buffer (Heartbleed) - CVE-2014-0160; and

• Improper restriction of operations within the bounds of a memory buffer - CVE-2012-2152

ICS-CERT reports that a relatively unskilled attacker could remotely exploit these vulnerabilities using publicly available exploit code to execute arbitrary code, to obtain private keys, or to impersonate the authenticated user and perform a man-in-the-middle attack.

NOTE: This is the ‘missing’ advisory that I reported on last week. Interestingly there is no mention in the advisory of the apparent fact that these vulnerabilities worked their way back into the system as part of the update to fix an earlier vulnerability.

ICS-CERT Publishes Siemens Advisory and Schneider Update

Late this afternoon the DHS ICS-CERT published a new advisory for the Siemens’ SICAM MIC telecontrol device and updated an earlier advisory for the Schneider OFS server. As of 17:20 CDT only the Siemens advisory is listed on the ICS-CERT landing page but the Schneider update is on the ICS-CERT site. I heard about it from an @ICS-CERT tweet just about 20 minutes ago.

Schneider Update

This advisory updates an earlier advisory released on May 21^st. For some reason I don’t have a copy of the original advisory, but it appears that Ivan Sanchez and Schneider found out that the original vulnerability had some sort of synergistic effect (the CVSS score went from 5.0 to 6.6) when the OFS Server was being run in conjunction with Vijeo Citect/CitectSCADA software.

It looks like Schneider is treating this as a separate vulnerability. ICS-CERT reports that Schneider has developed “additional patches that mitigates additional vulnerabilities”, but they don’t describe those ‘additional vulnerabilities’.

Schneider released this on their secure server on May 29^th and publicly released it on June 30^th.

Siemens Advisory

This advisory describes an authentication bypass vulnerability in the Siemens SICAM MIC telecontrol device. The vulnerability was originally reported by Philippe Oechslin from Objectif Sécurité. Siemens has produced a firmware update to mitigate the vulnerability, but there is no indication that Oechslin has been given an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability to perform administrative functions on the device. ICS-CERT reports that network access to the web interface is required and an authorized user must be logged on to the web server when the attack is initiated.

ICS-CERT Publishes Two Advisories

This afternoon the DHS ICS-CERT published two new advisories for control system vulnerabilities in systems from Siemens and PACTware.

PACTware Advisory

This advisory describes a handling of exceptional conditions vulnerability in PACTware Consortium’s PACTware application. The vulnerability was reported by Ivan Sanchez from Nullcode Team. PACTware has produced a service pack for the application and ICS-CERT reports that Sanchez has verified the efficacy of the fix.

ICS-CERT reports that a social engineering attack would have to be used to convince an operator to load and run a specially crafted file.

ICS-CERT reports that the new version (Service Pack 3) can be downloaded from the PACTware Consortium site. There are actually seven different companies using that web site to distribute PACTware 4.1. But only one of the seven companies, KROHNE Messtechnik GmbH,  listed on the site clearly has 4.1 SP3 available for download. I could not find the PACTware download on two of the sites and the other four did not list either version numbers or SP numbers.

Siemens Advisory

This advisory describes a cross site scripting vulnerability in the Siemens Climatix BACnet/IP communication module. The vulnerability was reported by Juan Francisco Bolivar Hernandez. Siemens has produced a firmware update to mitigate the vulnerability. There is no indication that Hernandez was given an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability.

The Siemens advisory on this vulnerability notes that the new firmware version has an additional security improvement; web server authentication is enabled by default.

ICS-CERT Publishes Two Advisories

This afternoon the DHS ICS-CERT published two advisories for vulnerabilities in industrial control systems from Schneider Electric and Wind River.

Schneider Advisory

This advisory describes a fixed search path vulnerability (Schneider calls it a binary planting vulnerability) in the Wonderware System Platform. The vulnerability was reported by Ivan Sanchez of WiseSecurity Team. Schneider has produced a patch to mitigate the vulnerability and according to ICS-CERT Sanchez has verified the efficacy of the fix.

ICS-CERT reports that this vulnerability would require a social engineering attack to get an authorized user to load a specially configured DLL file. A successful exploit would allow execution of arbitrary code.

Wind River Advisory

This advisory describes a TCP predictability vulnerability in the VxWorks operating system. The vulnerability was reported by Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech. Wind River has produced patches for the vulnerability, but there is no indication that the Georgia Tech team has been given the opportunity to verify the efficacy of the fix.

ICS-CERT reports that VxWorks is used in a number of ICS devices from a number of vendors. The VxWorks web site notes that the operating system is used in drones, medical devices and consumer IOT devices in addition to the ICS devices. ICS-CERT has contacted a number of vendors about the vulnerability. To date only Schneider Electric has produced a firmware patch to fix the VxWare vulnerability in some of their SAGE RTUs. Additional updates to the advisory will be issued when additional vendor information becomes available.

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability to spoof or disrupt TCP connections to the affected devices. The Schneider advisory [.PDF Download] for the Sage RTUs notes that a successful exploit could allow a man-in-the-middle attack.

ICS-CERT Publishes Update and Two Advisories

Yesterday the DHS ICS-CERT published an update for a year-old OleumTech advisory and two new advisories for systems from Emmerson and Schneider.

OleumTech Update

This update effectively closes out the mitigation side of a very peculiar advisory issued last year. In that original advisory ICS-CERT published their document without any apparent agreement from OleumTech that vulnerabilities actually existed. This update takes out two very interesting sentences from the original now that OleumTech has published updates that resolve the vulnerabilities. Those sentences stated:

“The researchers have coordinated the vulnerability details with NCCIC/ICS-CERT and OleumTech in hopes the vendor woulddevelop security patches to resolve these vulnerabilities. While ICS-CERT has had many discussions with both OleumTech and IOActive this past year, there has not been consensus on vulnerability details and positive product developments to resolve identified vulnerabilities.”

In discussing the now available updates for the systems ICS-CERT also removes the following description of the original OleumTech response:

“The vendor and IOActive researcher team do not completely agree with ICS-CERT about the severity and validity of these vulnerabilities. The vendor has stated they do not plan to resolve vulnerabilities they consider not valid.”

I suspect that OleumTech made some changes in their system unrelated to the reported vulnerabilities and realized that they could be considered to be mitigation measures and reported that to ICS-CERT. There is no indication that the original researchers have been given the chance to verify the efficacy of the fixes. In any case it looks like it took two years to fix the vulnerabilities.

Emmerson Advisory

This advisory describes an SQL injection vulnerability in the Emerson AMS Device Manager Application. This vulnerability was apparently self-reported and Emerson has developed a patch for newer versions of the system and a configuration fix for older versions.

ICS-CERT reports that a moderately skilled attacker could exploit this vulnerability to gain privilege escalation on the device manager, but not to the underlying computer system.

This advisory was originally released on the US CERT Secure Portal on April 21^st. It seems odd to me that a vulnerability that requires local access to exploit would get released on the Secure Portal for a month before public release when many more serious and remotely exploitable vulnerabilities get public release immediately.

Schneider Advisory

This advisory describes a DLL hijacking vulnerability in the Schneider OPC Factory Server (OFS) application. The vulnerability was originally reported by Ivan Sanchez from Nullcode Team. Schneider has produced a patch that mitigates the vulnerability and Sanchez has been given the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a social engineering attack is required to exploit this vulnerability. A successful exploit could cause a server crash or allow execution of arbitrary code. The Schneider advisory (.PDF Download) does not mention the possibility of code execution.

ICS-CERT Publishes Rockwell Advisory

This morning the DHS ICS-CERT published an advisory for a stack-based buffer overflow vulnerability in Rockwell Automations OPCTest.exe application in their RSLinx Classic. The vulnerability was reported by Ivan Sanchez of WiseSecurity Team. Rockwell has produced a new version that mitigates the vulnerability but there is no indication that Sanchez was given the opportunity to verify the efficacy of the fix. This advisory was originally released on the US CERT secure portal on April 21^st, 2015.

ICS-CERT reports that it would take a relatively skilled attacker to execute a social engineering attack to get an authorized user to load the specially crafted file. The Rockwell advisory for this vulnerability is only available to registered users.

It is interesting that this looks like exactly like the same stack-based buffer overflow vulnerability reported last week in the Opto 22 advisory that OPTO blamed on the Rockwell OPCTest.exe application that they used in their device. There are different CVE numbers for the two vulnerabilities, but they were both discovered by Sanchez. This may also explain why the Opto 22 advisory was not issued until April 30^th (nine days after the Rockwell alert was released to the Secure Portal) when Opto published their advisory on April 7^th. A lot more people use the Rockwell equipment.

BTW: How many other vendors are using the same OPCTest.exe application from Rockwell?

ICS-CERT Publishes OPTO 22 Advisory

This afternoon the DHS ICS-CERT published an advisory for twin buffer overflow vulnerabilities in OPTO 22 products. The vulnerabilities were reported by Ivan Sanchez from Nullcode Team. OPTO has released new versions that mitigate the vulnerabilities and Sanchez has been able to verify the efficacy of the fix.

The twin vulnerabilities are:

∙ Heap-based buffer overflow, CVE-2015-1006; and

∙ Stack-based buffer overflow, CVE-2015-1007.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the heap-based overflow vulnerability. The Stack-based overflow would require a social engineering attack before the vulnerability could be remotely exploited.

OPTO reports that the stack-based overflow vulnerability actually resides in a Rockwell OPC Test Client application (no version number is provided). The newer, unaffected OPTO 22 products use a ProSys Test Client application instead. Owners can obtain a copy of the ProSys Test Client from the OPTO 22 FTP site if they do not want to install the updated version of the PAC Project applications.

This is apparently just another case of a vendor using another vendor’s files without understanding the included vulnerabilities. It would be interesting if someone (ICS-CERT MAYBE) would look to see how many other systems were using the vulnerable Rockwell OPC Test Client.

ICS-CERT Publishes Rockwell Advisory

Today the DHS ICS-CERT published an advisory for a DLL hijack vulnerability in Rockwell Automation’s FactoryTalk View Studio product. The vulnerability was reported by Ivan Sanchez of NullCode & Evilcode Team. Rockwell has produced a patch that mitigates the vulnerability but there is no indication that Sanchez was provided an opportunity to verify the efficacy of the patch.

ICS-CERT reports that a social engineering attack would be necessary to exploit this vulnerability.

Apparently ICS-CERT is changing the way they describe the remote exploit possibility of vulnerability. Instead of saying that the vulnerability is ‘not remotely exploitable’ as we have seen in some DLL related advisories in the recent past, they now say: “These vulnerabilities are not exploitable remotely without user interaction.” This seems to me to be a concise and accurate description of the situation.

Note: It looks like this may be the advisory that I reported as being posted on the US-CERT Secure portal recently. The advisory notes that it was posted to the portal on March 3^rd.

ICS-CERT Publishes Three Advisories

This afternoon the DHS ICS-CERT published three advisories in control systems from Schneider, Kepware and Software Toolbox.

Schneider Advisory

This advisory describes a buffer overflow vulnerability in the Schneider Invensys SRD Control Valve Positioner. The vulnerability was reported by Ivan Sanchez from Nullcode Team. Schneider has produced a new version of the software that mitigates the vulnerability, but there is no indication that Sanchez has verified the efficacy of the fix.

ICS-CERT reports that a local user is required to load a malformed DLL file before the vulnerability is exploitable. A successful exploit could result in arbitrary code execution. Schneider reports that once the DLL file is loaded the vulnerability is remotely exploitable. They don’t mention anything about loading a ‘malformed DLL file’; it is apparently a DLL file that is part of the software package.

Kepware Advisory

This advisory describes a resource exhaustion vulnerability reported by Crain and Sistrunk (back in December 2013 according to Adam Crain) in the Kepware DNP Master Driver. Kepware has produced a new version that mitigates the vulnerability, though there is no indication that Crain or Sistrunk have verified the efficacy of the fix.

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability to crash the OPC Server.

The ICS-CERT discussion of the vulnerability appears to imply that a similar vulnerability might be found in other implementations of the DNP3 protocol. It notes that there is a DNP3 Application Note addressing the situation.

This looks like it was one of two remaining unresolved DNP3 vulnerabilities listed on the Project Robus website.

Software Toolbox Advisory

This advisory is a near duplicate of the Kepware advisory discussed above except that it involves the Software Toolbox Top Server. If this is, in fact, the second unresolved DNP3 vulnerability listed on the Project Robus site, I kind of suspect that these two vendors may be the only two with this specific implementation issue. Crain-Sistrunk would have looked for this in other implementations; they are kind of thorough that way.

ICS-CERT Publishes ABB Robot Advisory

This afternoon the DHS ICS-CERT published an advisory for a dll hijack vulnerability in the ABB RobotStudio and Test Signal Viewer applications. This vulnerability was reported by Ivan Sanchez of WiseSecurity Team in a coordinated disclosure. ABB has produced new versions of the affected applications and ICS-CERT reports that Sanchez has validated the efficacy of the fix.

ICS-CERT reports that a moderately skilled attacker with local access could exploit this vulnerability to execute arbitrary code.

ABB reports (in separate advisories for RobotStudio and Test Signal Viewer; both .PDF files) that the vulnerability is in a third-party component of the applications. The question this raises is what third-party component and who else uses the same component with the same vulnerability.