2 Advisories and 1 Update Published – 07-23-19

Yesterday the DHS NCCIC-ICS published two control system security advisories for products from National Renewable Energy Laboratory (NREL) and Mitsubishi Electric. They also updated a previously published medical device advisory from GE Healthcare.

NREL Advisory

This advisory describes a stack-based buffer overflow vulnerability in the NREL EnergyPlus Energy simulation program. The vulnerability was reported by Karn Ganeshen. NREL has an update available that mitigates the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to execute arbitrary code or cause a denial-of-service condition.

NOTE: There is nothing on the DOE’s EnergyPlus web site about this vulnerability, nor do I see any POC for reporting cybersecurity concerns. DOE, really?

Mitsubishi Advisory

This advisory describes two vulnerabilities in the Mitsubishi Electric FR Configurator. The vulnerability was reported by Applied Risk. Mitsubishi has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper restriction of an XML external entity reference - CVE-2019-10976; and

• Uncontrolled resource consumption - CVE-2019-10972

NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to enable arbitrary files to be read or cause a denial-of-service condition.

GE Update

This update provides additional information on an advisory that was originally reported on July 9^th, 2019. The new information is the addition of more covered products.

NOTE: I briefly reported on GE’s update last Saturday.

7 Advisories and 7 Updates Published

Yesterday the DHS NCCIC-ICS published seven control system security advisories for products from Fuji Electric, Hangzhou Xiongmai Technology Co, Siemens (4) and GE. They also updated seven previously issued advisories for products from Siemens.

Fuji Advisory

This advisory describes an uncontrolled search path element advisory in the Fuji Electric Energy Savings Estimator. The vulnerability was reported by Karn Ganeshen. Fuji has released an update that mitigates the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker with uncharacterized access could exploit this vulnerability to allow an attacker to load a malicious DLL and execute code on the affected system with the same privileges as the application that loaded the malicious DLL.

Hangzhou Advisory

This advisory describes three vulnerabilities in the Hangzhou XMeye P2P Cloud Server. The vulnerabilities were reported by Stefan Viehböck of SEC Consult Vulnerability Lab. Hangzhou has not provided mitigations for these vulnerabilities.

The three reported vulnerabilities are:

• Predictable from observable state - CVE-2018-17917;

• Hidden functionality - CVE-2018-17919; and

• Missing encryption of sensitive data - CVE-2018-17915

NCCIC-ICS reports that a relatively low-skilled attacker with remote access could use a publicly available exploit to exploit these vulnerabilities to allow unauthorized access to video feeds with the potential to modify settings, replace firmware, and/or execute code.

SIMATIC S7-1500 Advisory

This advisory describes an improper input validation vulnerability in the Siemens SIMATIC S7-1500, SIMATIC S7-1500 Software Controller and SIMATIC ET 200SP Open Controller. The vulnerability was reported by Marcin Dudek, Jacek Gajewski, Kinga Staszkiewicz, Jakub Suchorab, and Joanna Walkiewicz from National Centre for Nuclear Research Poland. Siemens has updates to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to cause a denial-of-service condition on the network stack.

SIMATIC S7-1200 Advisory

This advisory describes a cross-site request forgery vulnerability in the Siemens SIMATIC S7-1200 CPU Family Version 4. The vulnerability was reported by Lisa Fournet and Marl Joos from P3 communications GmbH. Siemens has a firmware update that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow a CSRF attack if an unsuspecting user is tricked into accessing a malicious link.

ROX II Advisory

This advisory describes two improper privilege management vulnerabilities in the Siemens ROX II. The vulnerabilities were reported by Gerard Harney from NCC Group (reported in Siemens advisory not NCCIC-ICS). Siemens has a new version that mitigates the vulnerabilities. There is no indication that Harney has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow valid users to escalate their privileges and execute arbitrary commands.

SCALANCE Advisory

This advisory describes a cryptographic issues vulnerability in the Siemens SCALANCE W1750D. The vulnerability is fully described on the Return of Bleichenbacher's Oracle Threat (ROBOT) web site. Siemens is self-reporting the vulnerability. Siemens has a firmware update that mitigates the vulnerability.

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit this vulnerability using publicly available exploits to allow an attacker to decrypt TLS traffic.

NOTE: I suspect that other ICS devices using TLS services could face similar TLS ROBOT problems. Too bad NCCIC-ICS has not done an alert on this issue. Then again, does NCCIC-ICS do alerts?

GE Advisory

This advisory describes an unsafe ActiveX control marked safe for scripting vulnerability in the GE Gigasoft component of iFix. The vulnerability was reported by LiMingzheng of 360 aegis security team. Recent versions of iFIX mitigate the vulnerability. There is no indication that LiMingzheg has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a buffer overflow condition.

Industrial Products Update

This update provides additional information on an advisory that was that originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th, February 27^th, 2018, May 3^rd, 2018 May 15^th, 2018, , and most recently on September 11^th, 2018. The new information includes revised affected versions data and mitigation measures for SIMATIC S7-1200 CPU.

SIMATIC Update

This update provides additional information on an advisory that was originally published on March 20^th, 2018. The new information includes revised affected versions data and mitigation measures for SINUMERIK 828D.

SIMATIC PCS7 Update

This update provides additional information on an advisory that was This update provides new information on an advisory that was originally published on November 2^nd, 2018 and updated on June 12^th, 2018. The new information includes revised affected versions data and mitigation measures for:

• OpenPCS 7 V8.1; and

• SIMATIC WinCC Runtime Professional V13

SIMATIC WinCC Update

This update provides additional information on an advisory that was originally published on April 19^th, 2018. The new information includes revised affected versions data and mitigation measures for WinCC OA Operatopr App.

SINAMICS Update

This update provides additional information on an advisory that was originally published on May 8^th, 2018. The new information includes revised affected versions data and mitigation measures for SINAMICS GM150 V4.7 w. PROFINET.

SIMATIC Step7 Update

This update provides additional information on an advisory that was originally published on August 14^th, 2018. The new information includes revised affected versions data and mitigation measures for:

• SIMATIC STEP 7 (TIA Portal); and

• WinCC (TIA Portal) V13

OpenSSL Update

This update provides additional information on an advisory that was originally published on August 14^th, 2018 and updated on September 11^th, 2018. The new information includes revised affected versions data and mitigation measures for:

• SIMATIC S7-1200 CPU;

• SIMATIC STEP 7 (TIA Portal) V13; and

• SIMATIC WinCC (TIA Portal) V13

ICS-CERT Publishes 3 Advisories and 2 Siemens Updates

Today the DHS ICS-CERT published three control system security updates for products from Leão Consultoria e Desenvolvimento de Sistemas (LCDS), Moxa, and Rockwell. They also updated two previously published control system security advisories for products from Siemens.

LCDS Advisory

This advisory describes an improper check of handling of exceptional conditions vulnerability in the LCDS LAquis SCADA. The vulnerability was reported by Karn Ganeshen. LCDS has a new version that mitigates the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a highly-skilled attacker with local access could exploit this vulnerability to cause the device an attacker is accessing to crash, resulting in a structured exception handler overflow condition, which may allow code execution.

Moxa Advisory

This advisory describes an information exposure vulnerability in the Moxa MXview, network management software. The vulnerability was reported by Michael DePlante of Leahy Center for Digital Investigation at Champlain College. Moxa developed a new version to mitigate the vulnerability. There is no indication that DePlante has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit this vulnerability to read the private key of the web server, which may allow a remote attacker to decrypt encrypted information.

Rockwell Advisory

This advisory describes six vulnerabilities in the Rockwell MicroLogix Controller. The vulnerabilities were reported by Jared Rittle and Patrick DeSantis of Cisco. Rockwell has provided mitigation strategies in their customer notification (registration required). There is no indication that the researchers were provided an opportunity to verify the efficacy of the fixes.

The six reported vulnerabilities (according to ICS-CERT) are:

• Improper authentication (6) - CVE-2017-12088, CVE-2017-12089, CVE-2017-12090, CVE-2017-12092, and CVE-2017-12093

NOTE: Rockwell does not use the ‘improper authentication’ description for any of the six (actually 17) vulnerabilities. Instead they report (using the same CVE numbers):

• Denial of service via ethernet functionality - CVE-2017-12088;

• Denial of service via download functionality - CVE-2017-12089;

• Denial of service – SNMP-set request - CVE-2017-12090;

• Access control vulnerabilities (12) - CVE-2017-14462 thru CVE-2017-14473;

• File-write vulnerability in memory module - CVE-2017-1209; and

• Malicious register session packets lead to communication loss - CVE-2017-12093

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to cause denial of service, disclosure of sensitive information, communication loss, and modification of settings or ladder logic.

SCALANCE Update

This update provides additional details on an advisory that was originally published on November 28^th, 2017. The new version provides updated mitigation information for the SCALANCE W1750D.

Building Technologies Products Update

This update provides additional details on an advisory that was originally published on April 3^rd, 2017. The new information provides a link to the updated LMS. I mentioned this new information in my earlier post.

ICS-CERT Publishes Alert, 3 Advisories and 1 Update

Yesterday ICS-CERT published an alert for the Intel Meltdown and Spectre vulnerabilities. They published three control system security advisories for products from Phoenix Contact, Moxa, and WECON. They also updated a previously published advisory for products from Advantech.

Meltdown Alert

This alert describes the CPU hardware vulnerable to side-channel attacks vulnerabilities known as  Meltdown and Spectre. The alert provides links to the following vendor notifications about these vulnerabilities:

• ABB;

• Becton, Dickinson and Company (BD); 

• Rockwell Automation (account required for login); and

• Siemens

The alert also provides a generic link to the ICS-CERT recommended practices page. It is disappointing that, in light of the problems seen with the Windows Update for Meltdown seen on some systems (here and here for example), ICS-CERT has not specifically mentioned the need for checking any updates on a test platform before uploading to a live control system.

Phoenix Contact Advisory

This advisory describes two vulnerabilities in the Phoenix Contact FL Switch product line. The vulnerabilities were reported by Ilya Karpov and Evgeniy Druzhinin of Positive Technologies. Newer versions of the firmware mitigate these vulnerabilities. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper authorization - CVE-2017-16743; and

• Information exposure - CVE-2017-16741

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to gain administrative privileges and expose information to unauthenticated users.

Moxa Advisory

This advisory describes an unquoted search path vulnerability in the Moxa MXview network management software. The vulnerability was reported by Karn Ganeshen. Moxa has produced a firmware update that mitigates the vulnerability. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker with locally authorized access could exploit the vulnerability to escalate privileges by inserting arbitrary code into the unquoted service path.

WECON Advisory

This advisory describes two vulnerabilities in the WECON LeviStudio HMI Editor. The vulnerabilities were reported by Sergey Zelenyuk of RVRT, HanM0u of CloverSec Labs, and Brian Gorenc via the Zero Day Initiative. The latest version of the software mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2017-16739; and

• Heap-based buffer overflow - CVE-2017-16737

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to effect arbitrary code execution.

Advantech Update

This update updates information on an advisory that was originally published on January 4^th, 2018. This update adds two vulnerabilities to those previously reported:

• Unrestricted upload of file with dangerous type - CVE-2017-16736 and

• Use after free - CVE-2017-16732

Public ICS Disclosure – Week of 10-29-17

This week Karn Ganeshen provided proof of concept (POC) information on three previously published ICS-CERT vulnerabilities and Joel Langill provided a link to an ABB KRACK advisory.

POC Information

Karn continues to use the FullDisclosure web site to provide to provide additional information about control system vulnerabilities that he has previously disclosed through the DHS ICS-CERT. This week he has provided POC information on the following control system vulnerabilities:

• Progea Movicon SCADA/HMI – earlier reported here (there was no mention of publicly available POC in the ICS-CERT advisory);

• JanTek JTC-200 – earlier reported here (publicly available POC was mentioned in ICS-CERT advisory); and

• SpiderControl SCADA Web Server – earlier reported here (there was no mention of publicly available POC in the ICS-CERT advisory)

Based upon past experience, I do not expect ICS-CERT to update their vulnerability reports to reflect the fact that POC information is now available. Given the fact that ICS-CERT has reported that relatively low skilled attackers could exploit these vulnerabilities, I think that it is important that owners of these systems has this information available to help them appropriately assess the risks to their systems.

KRACK Vulnerability

Joel’s post on LinkedIn pointed at a cybersecurity advisory from ABB for their  ABB TropOS wireless mesh products concerning the WPA2 Key Reinstallation Vulnerabilities (also known as the Key Reinstallation Attack – KRACK).

As I pointed out in the resulting LinkedIn conversation this is the second vendor specific advisory on the KRACK vulnerability. Unlike the earlier report, ABB includes 7 of the 10 CVE found in the KRACK report, indicating that they have probably reviewed all 10 of the vulnerabilities in their system.

I continue to be disappointed in ICS-CERT for not having published a control system alert for the KRACK problem since these vulnerabilities will affect almost all ICS products that use WPA2 security for wireless communications in their control system products.

ICS-CERT Publishes Two Advisories

Today the DHS ICS-CERT published two control system security advisories for products from Trihedral Engineering and ABB. The ABB advisory addresses a vulnerability that I addressed ten days ago.

Trihedral Advisory

This advisory describes two vulnerabilities in the Trihedral VTScada. The vulnerabilities were independently reported by Karn Ganeshen and Mark Cross. Trihedral has a new version that mitigates the vulnerabilities. There is no indication that either researcher has been provided the opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper access control - CVE-2017-14031;

• Uncontrolled search path element - CVE-2017-14029

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit the vulnerability to allow execution of arbitrary code.

NOTE: If one were to look for one possible explanation about why owner/operators are slow to update their ICS software, one would need to look no further than the Trihedral upgrade notes for moving from v11.2 to the current version. Lots of work and lots of tools do not carry over to the newest version.

ABB Advisory

This advisory describes an improper input validation vulnerability in the ABB FOX515T. The vulnerability was reported by Ketan Bali. ABB reports that the device has been phased out and is no longer being supported. The ABB cybersecurity advisory reports that there are no work around available for this vulnerability.

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit this vulnerability to craft a malicious script that would enable retrieval of any file on the server.

Commentary

Two security researchers independently detecting and reporting the same vulnerabilities is not real common, but I suspect that is more due to the reporting component of that statement rather than the detection component. This is an important concept for security researchers and vendors to remember when they decide whether or not to communicate vulnerabilities.

For vendors trying to determine whether or not to report an in-house detected vulnerability they first have to determine if they are going to (or can) patch/upgrade to mitigate the vulnerability. If they do not patch, they are risking having an independent researcher/team discover the vulnerability and either misuse it or selling it to somewhere.

If the vendor fixes the vulnerability the question arises of whether or not to report the underlying vulnerability or letting the update stand on routine improvements to the device/system. As I have mentioned before, ICS owners are slow to update for any number of reasons; the risk of a security vulnerability un-fixed may be the incentive needed to upgrade to a newer version.

ICS-CERT Publishes 2 Advisories and 1 Update

Today the DHS ICS-CERT published one medical control system security advisory for a product from Boston Scientific. Additionally, they published an industrial control system advisory for a product from SpiderControl. They also updated a medical control system advisory for a product from Becton, Dickinson and Company.

Boston Scientific Advisory

This advisory describes two vulnerabilities for the Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM). The vulnerabilities were reported by Jonathan Butts and Billy Rios of Whitescope. Boston Scientific has provided mitigating controls. ICS-CERT reports that Boston Scientific will not be fixing the vulnerabilities.

The two reported vulnerabilities are:

• Use of hard-coded cryptographic key - CVE-2017-14014; and

• Missing encryption of sensitive data - CVE-2017-14012

ICS-CERT reports that an uncharacterized attacker with physical access to the device could exploit these vulnerabilities to obtain patient health information (PHI).

SpiderControl Advisory

This advisory describes an uncontrolled search path element vulnerability in the SpiderControl MicroBrowser, a touch panel operating system. The vulnerability was reported by Karn Ganeshen. SpiderControl has provided a new version that mitigates the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to execute arbitrary code on the target system.

BD Update

This update provides additional information on an advisory that was originally published on February 7^th, 2017. The updated information includes:

• The identification of “Researchers at Zingbox” as being involved in the reporting of the vulnerabilities;

• The expansion of the impact statement to include the ability to “compromise the confidentiality, integrity, and availability of the device”;

• The information that an internal removeable flash drive which in some versions provides access to “wireless network authentication credentials and other sensitive technical data on the affected device’s removable flash memories”;

• Updated mitigation measures; and

• A link to the updated BD security bulletin [.PDF download] which provides additional details on the information accessible due to the reported vulnerabilities

ICS-CERT Publishes Progea Advisory

Today the DHS ICS-CERT published a control system security advisory for the Progea Movicon SCADA/HMI. It describes two vulnerabilities in the product. The vulnerabilities were reported by Karn Ganeshen. Progea has only provided a generic Microsoft workaround for DLL hijacking at this point. ICS-CERT does not report any further scheduled response.

The two reported vulnerabilities are:

• Uncontrolled search path element - CVE-2017-14017; and

• Unquoted search path or element - CVE-2017-14019

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to allow privilege escalation or arbitrary code execution.

ICS-CERT Publishes Two Advisories

Yesterday the DHS ICS-CERT published two advisories. One was a medical device security advisory for products from Philips. The other was a control system advisory for products from mySCADA.

Philips Advisory

This advisory describes two vulnerabilities in the Philips IntelliVue MX40 Patient Worn Monitor. The vulnerabilities are self-reported. There are no FDA Safety Communications about these vulnerabilities. Philips has issued an update that mitigates one of the vulnerabilities; another update is due later this year.

The two reported vulnerabilities are:

• Improper cleanup on thrown exception - CVE-2017-9657; and

• Improper handling of exceptional conditions - CVE-2017-9658

ICS-CERT reports that a relatively low skilled attacker with access to an adjacent network could exploit these vulnerabilities to issue 802.11 Wi-Fi management commands that can impact reporting availability of MX40 device local monitoring to a central monitoring station.

mySCADA Advisory

This advisory describes an unquoted search path or element vulnerability in the mySCADA myPRO HMI/SCADA management platform. The vulnerability was reported by Karn Ganeshen, who publicly disclosed the vulnerability on 7-28-17. mySCADA has produced a new version that mitigates the vulnerability. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker but authenticated attacker to execute arbitrary code with elevated privileges.

NOTE: Karn is pretty well known for his coordinated disclosure, so this public disclosure is unusual. There are no explanations on either the ICS-CERT or the iPositiveSecurity web site explaining why the early disclosure was made. It would be interesting to know ‘the rest of the story’.

ICS-CERT Publishes 4 Advisories

Today the DHS ICS-CERT published two medical device security advisories for products from Smiths Medical and i-SENS. They also published to control system security advisories for products from PHOENIX CONTACT and SpiderControl.

Smiths Medical Advisory

This advisory describes eight vulnerabilities in the Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump. The vulnerabilities were reported by Scott Gayou. Smiths Medical is developing a new product version to mitigate the vulnerabilities; compensating controls have been developed.

The eight reported vulnerabilities are:

• Buffer copy without checking size of input - CVE-2017-12718;

• Out-of-bounds read - CVE-2017-12722;

• Use of hard-coded credentials - CVE-2017-12725, CVE-2017-12724;

• Improper access control - CVE-2017-12720;

• Use of hard-coded password - CVE-2017-12726;

• Improper certificate validation - CVE-2017-12721; and

• Password in configuration file - CVE-2017-12723

ICS-CERT reports that an uncharacterized attacker could remotely exploit the vulnerabilities to gain unauthorized access and impact the intended operation of the pump. Despite the segmented design, it may be possible for an attacker to compromise the communications module and the therapeutic module of the pump.

No FDA safety communication has been released on these vulnerabilities.

i-SENS Advisory

This advisory describes an uncontrolled search path element vulnerability in the i-SENS SmartLog Diabetes Management Software. The vulnerability was reported by Mark Cross. i-SENS has produced a new version that mitigates the vulnerability. ICS-CERT reports that Cross has been provided the opportunity to verify the efficacy of the fix.

ICS-CERT reports that an authorized user with local access could exploit the vulnerability to execute arbitrary code on the target system.

PHOENIX CONTACT Advisory

This advisory describes a null pointer deference vulnerability in the PHOENIX CONTACT mGuard firmware. This vulnerability was self-reported. PHOENIX CONTACT has produced a firmware version that mitigates the vulnerability.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to cause a remote denial of service and force a restart of all IPSec connections.

SpiderControl Advisory

This advisory describes an improper privilege management vulnerability in the SpiderControl SCADA Web Server. The vulnerability was reported by Karn Ganeshen. SpiderControl has produced a new version that mitigates the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker with authorized access could exploit the vulnerability to escalate their privileges under certain conditions.

Public ICS Disclosure – Week of 9-25-17

This week Karn Ganeshen provided exploit information on the Full Disclosure web site for vulnerabilities that he had previously coordinated with ICS-CERT. Most of them are relatively simple DLL insertions so there is nothing here that the experienced researcher would not have been able to deduce from the ICS-CERT reports on the vulnerabilities. I include these here since ICS-CERT will not update their advisories to indicate that exploits are publicly available.

The affected products include:

• Schneider Electric Pro-Face WinGP – ICSA-17-215-01;

• Solar Controls WATTConfig M Software - ICSA-17-222-03;

• Solar Controls Heating Control Downloader - ICSA-17-222-02;

• SIMPlight SCADA Software - ICSA-17-222-01;

• SpiderControl SCADA Web Server - ICSA-17-234-03;

• Spider Control SCADA MicroBrowser - ICSA-17-234-02;

• Moxa SoftNVR-IA Live Viewer - ICSA-17-220-02; and

• AzeoTech DAQFactory - ICSA-17-241-01

ICS-CERT Publishes Three Advisories

Today the DHS ICS-CERT published two control system security advisories for products from Advantech and AzeoTech. They also published a medical device advisory for products from Abbott Laboratories.

Advantech Advisory

This advisory describes nine vulnerabilities in the Advantech WebAccess HMI platform. The vulnerabilities were reported by  Fritz Sands, independent researcher rgod, Tenable Network Security, and an anonymous researcher (all via Zero Day Initiative), and Haojun Hou and DongWang from ADLab of Venustech. Advantech has released a new version to mitigate the vulnerabilities. There is no indication that any of the researchers have been provided an opportunity to verify the efficacy of the fix.

The nine reported vulnerabilities are:

• Improper neutralization of special elements used in an SQL command - CVE-2017-12710;

• Improper restriction of operations within the bounds of a memory buffer - CVE-2017-12708;

• Stack-based buffer overflow -CVE-2017-12706;

• Heap-based buffer overflow - CVE-2017-12704;

• Use of externally-controlled format string - CVE-2017-12702;

• Improper authentication - CVE-2017-12698;

• Incorrect permission assignment for critical resource - CVE-2017-12713;

• Incorrect privilege assignment - CVE-2017-12711; and

• Uncontrolled search path element - CVE-2017-12711

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to allow remote code execution or unauthorized access and could cause the device that the attacker is accessing to crash.

NOTE: Earlier this month I mentioned that there were  a large number of ‘pending’ vulnerability reports on Advantech products currently listed on the ZDI web site. These are not those vulnerabilities; those are still apparently being resolved.

AzeoTech Advisory

This advisory describes two vulnerabilities in the AzeoTech DAQFactory HMI. The vulnerabilities were reported by Karn Ganeshen. AzeoTech has produced a new version that mitigates the vulnerabilities. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Incorrect default permissions - CVE-2017-12699; and

• Uncontrolled search path element - CVE-2017-5147

ICS-CERT reports that an authenticated user with local access could exploit the vulnerabilities to escalate their privileges and modify or replace application files.

Abbott Labs Advisory

This advisory describes three vulnerabilities in the Abbot Labs (formerly St. Jude Medical) pacemakers. The vulnerabilities were reported by MedSec. Abbott has produced a firmware update that mitigates the vulnerability. ICS-CERT reports that an unidentified third-party has verified the efficacy of the fix. The FDA Safety Communication notes that the firmware update must be applied during “an in-person patient visit with a health care provider”.

The three reported vulnerabilities are:

• Improper authentication - CVE-2017-12712;

• Improper restriction of power consumption - CVE-2017-12714; and

• Missing encryption of sensitive data - CVE-2017-12716

ICS-CERT reports that an uncharacterized attacker near the patient could exploit the vulnerabilities to gain unauthorized access to a pacemaker and issue commands, change settings, or otherwise interfere with the intended function of the pacemaker.

ICS-CERT Publishes 3 Advisories

Today the DHS ICS-CERT published three control system security advisories for products from SpiderControl (2) and Automated Logic Corporation.

SCADA Web Server Advisory 

This advisory describes a path traversal vulnerability in the SpiderControl SCADA Web Server. The vulnerability was reported by Karn Ganeshen via the Zero Day Initiative (ZDI). SpiderControl has produced a new version that mitigates the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to gain read access to system files through directory traversal.

SCADA MicroBrowser Advisory

This advisory describes a stack-based buffer overflow vulnerability in the SpiderControl SCADA MicroBrowser. The vulnerability was reported by Karn Ganeshen via ZDI. SpiderControl has produced a new version that mitigates the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to gain access to the system, manipulate system files, and potentially render the system unavailable.

Automated Logic Advisory

This advisory describes three vulnerabilities in the ALC WebCTRL, i-Vu, and SiteScan Web. The vulnerabilities were reported by Gjoko Krstic from Zero Science Lab. ALC has produced patches that mitigate the vulnerabilities. There is no indication that Krstic has been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Unquoted search path or element - CVE-2017-9644;

• Path traversal - CVE-2017-9640; and

• Unrestricted upload of file with dangerous type - CVE-2017-9650

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to elevate his or her privileges to execute arbitrary code on the system.

ICS-CERT Publishes 5 Advisories

Yesterday the DHS ICS-CERT published five control system security advisories for products from ABB, Fuji Electric, Solar Controls (2), and SIMPlight.

ABB Advisory

This advisory describes a relative path traversal vulnerability in the ABB SREA-01 and SREA-50 remote monitoring tools. The vulnerability was reported by Bertin Jose and Fernandez Ezequiel. HMS Industrial Networks Ab provided a patch to correct the issue, but ABB has only tested it on the SREA-01. These are unsupported legacy products. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker could use publicly available exploits to remotely exploit the vulnerability to access files on the affected products’ file systems, view data, change configuration, retrieve password hash codes, and potentially insert and send commands to connected devices without authorization.

NOTE: ABB reports that exploit code was published on github by the researchers.

Fuji Advisory

This advisory describes multiple vulnerabilities in the Fuji Monitouch V-SFT screen configuration software. The vulnerabilities were reported by Fritz Sands and kimiya via the Zero Day Initiative. Fuji has released a new version to mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2017-9659;

• Heap-based buffer overflow - CVE-2017-9660; and

• Improper privilege management - CVE-2017-9662

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to allow remote code execution or cause the software that the attacker is accessing to crash. The improper privilege management vulnerability could allow an attacker with local access to escalate privileges.

WATTConfig Advisory

This advisory describes an uncontrolled search path element vulnerability in the Solar Controls WATTConfig M Software. The vulnerability was reported by Karn Ganeshen. ICS-CERT reports that Solar Controls has not responded to requests to coordinate with NCCIC/ICS-CERT.

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit the vulnerability to allow arbitrary code execution.

HCDownloader Advisory

This advisory describes an uncontrolled search path element vulnerability in the Solar Controls Heating Control Downloader (HCDownloader). The vulnerability was reported by Karn Ganeshen. ICS-CERT reports that Solar Controls has not responded to requests to coordinate with NCCIC/ICS-CERT.

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit the vulnerability to allow arbitrary code execution.

SIMPlight Advisory

This advisory describes an uncontrolled search path element vulnerability in the the SIMPlight SCADA Software. ). The vulnerability was reported by Karn Ganeshen. ICS-CERT reports that Solar Controls has not responded to requests to coordinate with NCCIC/ICS-CERT.

ICS-CERT reports that a relatively low skilled attacker with uncharacterized access could exploit the vulnerability to allow arbitrary code execution.

ICS-CERT Publishes Two Advisories

Today the DHS ICS-CERT published two control system security advisories for products from Moxa and OSIsoft. I mentioned the OSIsoft vulnerabilities in a blog post last month.

Moxa Advisory

This advisory describes an uncontrolled search path element vulnerability in the Moxa SoftNVR-IA Live Viewer. The vulnerability was reported by Karn Ganeshen. Moxa has developed an update to mitigate the vulnerability. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to execute code from a malicious DLL on the affected system with the same privileges as the application that loaded the malicious DLL.

OSIsoft Advisory

This advisory describes two vulnerabilities in the OSIsoft PI Integrator. The vulnerabilities are self-reported. OSIsoft developed new versions of the software to mitigate the vulnerabilities.

The two reported vulnerabilities are:

• Cross-site scripting - CVE-2017-9655; and

• Improper authorization - CVE-2017-9653

 ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to gain privileged access to the system. An attacker may also be able to store a malicious script in the application database.

BTW: Siemens published a new advisory and updated two advisories yesterday (notification on TWITTER® here, here, and here). I had kind of expected ICS-CERT to report on these today. Maybe tomorrow….

ICS-CERT Publishes 3 Advisories

Today the DHS ICS-CERT published two medical system advisories for products from Siemens and one control system advisory for products from Schneider Electric.

Molecular Imaging Advisory 1

This advisory describes two vulnerabilities in Siemens’ Molecular Imaging products running on Windows XP. These vulnerabilities are apparently self-reported. Siemens is working on updates for these vulnerabilities and recommend disconnecting the devices from networks pending receipt of those updates.

The two reported vulnerabilities:

• Improper control of generation of code - CVE-2008-4250; and

• Improper restriction of operations within the bounds of a memory buffer - CVE-2017-7269

ICS-CERT reports that an uncharacterized attacker could remotely exploit the vulnerabilities to remotely execute arbitrary code.

Note: Neither the ICS-CERT advisory nor the Siemens security advisory report that there are a number of publicly available exploits for the 2008 Windows XP RPC vulnerability.

Molecular Imaging Advisory 2

This advisory describes multiple vulnerabilities in Siemens’ Molecular Imaging products running on Windows 7. These vulnerabilities were apparently self-reported. Siemens is working on updates for these vulnerabilities and recommend disconnecting the devices from networks pending receipt of those updates.

The reported vulnerabilities are:

• Improper control of generation of code (2) - CVE-2015-1635 and CVE-2015-1497;

• Improper restriction of operations within the bounds of a memory buffer - CVE-2015-7860; and

• Permissions, privileges and access controls - CVE-2015-7861

ICS-CERT reports that an uncharacterized attacker could use publicly available exploits to remotely exploit the vulnerabilities to remotely execute arbitrary code.

NOTE: Both these advisories note that while disconnecting the devices from networks is a useful mitigation technique, they should be reconnected so that the updates can be remotely applied by Siemens. This is one important difference between medical devices and control system advisories; updates only affect the device being updated so remote updates are an effective option in most medical devices.

Schneider Advisory

This advisory describes an uncontrolled search path element vulnerability in the Schneider Pro-face GP-Pro EX. The vulnerability was reported by Karn Ganeshen. Schneider has developed an update that mitigates the vulnerability. There is no indication that Ganeshen was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker with uncharacterized access could use publicly available exploits to allow arbitrary code execution. The Schneider security bulletin that physical access to the computer is required.

Commentary

I continue to be concerned with some delays in ICS-CERT’s publication of advisories. The Siemens’ advisories were both published a while back (July 17^th and July 26^th). While these are both medical devices (and really outside of the ICS-CERT mandate) and Siemens does a good job publicly communicating their vulnerabilities, these vulnerabilities both had publicly available exploits. This makes prompt mitigation especially important, even when it is nothing more than disconnecting the device from networks pending updates.

I suppose that it really comes down to what the role of ICS-CERT is in communicating control system (and now medical device) vulnerabilities. If their role is simply reporting vulnerabilities reported to it by researchers and vendors, then delays such as these are vendor issues not ICS-CERT issues.

Of course, if ICS-CERT is intended to be more of a cybersecurity resource for system owner than an information sharing tool for vendors, then ICS-CERT is going to have to be more proactive in monitoring major vendor public communications and the cybersecurity press for researcher reports of ICS vulnerabilities and mitigations.

To be fair, that will probably require more resources than currently allocated for information sharing. And that resource allocation issue is not one should (or probably can) be resolved at their level, it is something that Congress is probably going to have to address. As control system security continues to become a more important societal issue, Congress is going to have to address the issue of the existence and role of ICS-CERT. In other words, ICS-CERT should specifically authorize ICS-CERT and establish its actual role in the industrial cybersecurity realm.

ICS-CERT Publishes Two Advisories

Today the DHS ICS-CERT published two control system security advisories for products from Schneider Electric and Mitsubishi Electric.

Schneider Advisory

This advisory describes multiple (365 Java Runtime Environment - JRE) vulnerabilities in the Schneider Trio TView Management Suite. The vulnerabilities were reported by Karn Ganeshen. Schneider has produced a new version that uses a newer version of JRE that does not have the reported vulnerabilities. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT does not try to list each of the previous reported vulnerabilities in JRE 1.6.0 update 27 (the Schneider security notice does by CVE). Instead ICS-CERT provides the following statistical evaluation:

• 180 vulnerabilities were identified as having a CVSS base score of 7.0-10;

• 161 vulnerabilities were identified as having a CVSS base score of 4.0-6.9; and

• 24 vulnerabilities were identified as having a CVSS base score of 0.0-3.9.

ICS-CERT generously reports that a relatively low skilled attacker could remotely use publicly available exploits  to compromise the Trio TView Management Suite.

NOTE: It is easy to criticize Schneider for not using updated versions of JRE (as they were issued) to update TView or at least use the latest version when TView was periodically updated. But, failing to do so made their job easier by not having to check that updated versions were forward compatible with the changes being made in TView. The big question, of course, is what other software, tools and libraries did Schneider also fail to update in this and other products.

Mitsubishi Advisory

This advisory describes multiple (NOT nearly as many as above – grin) vulnerabilities in the Mitsubishi E-Designer (HMI design software). The vulnerabilities were reported by Andrea “rgod” Micalizzi. This product is no longer supported by Mitsubishi. They recommend replacing HMIs designed with E-Designer with ones designed with new Mitsubishi GT Works.

The reported vulnerabilities are:

• Stack-based buffer overflow (6) - CVE-2017-9638;

• Heap-based buffer overflow (5) - CVE-2017-9636; and

• Out of bounds write (2) - CVE-2017-9634

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to corrupt sensitive information, crash the system, conduct a denial of service attack, and execute arbitrary code.

NOTE: It appears that E-Designer was written by Beijer Electronics. Their web site claims that E-Designer is nearly identical to their Information Designer, which is used to program the EXTER HMIs. It would be reasonable to assume that at least some of these vulnerabilities might be found by an enterprising researcher in those Beijer products.

Public ICS Disclosure – Week of 6-24-17

On Friday Karn Ganeshen described an uncontrolled search path element vulnerability in the Schneider Electric Pro-Face WinGP in a post on SECLISTS.com. The information provided includes a proof-of-concept exploit. There is no information provided indicating any attempts at coordinated disclosure.

Earlier this week Ganeshen also published proof-of-concept exploits for two other Schneider products for which an ICS-CERT advisory had been published; ICSA-17-094-01 and

ICSA-17-138-02.

ICS-CERT Publishes Advisory and Updates 5 Siemens Advisories

Today the DHS ICS-CERT published one new control system security advisory for a product from Cambium Networks and updated five previously published advisories for products from Siemens.

Cambium Advisory

This advisory describes two vulnerabilities in the Cambium ePMP Network Access Control products. The vulnerabilities were reported by Karn Ganeshen. According to Cambium, newer versions of the firmware are not affected. There is no indication that Ganeshen was provided an opportunity to verify that.

The two reported vulnerabilities are:

• Improper access control - CVE-2017-7918; and

• Improper privilege management - CVE-2017-7922

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to access device configuration as well as make unauthorized changes to the product’s configuration.

ICS-CERT also notes that Cambium also recommends that users edit default SNMP configuration.

PROFINET Update 1

This update provides additional information on the advisory that was originally published on May 9^th, 2017. The update provides new information on the affected version of and links to the updates for:

• SIMATIC STEP 7 V5.X: All versions prior to V5.6;

• SIMATIC WinCC: All versions prior to V7.4 SP1 Upd1; and

• Security Configuration Tool (SCT): All versions prior to V5.0

PROFINET Update 2

This update provides additional information on the advisory that was originally published on May 9^th, 2017. The update provides new information on the affected version of and links to the updates for:

• SCALANCE X300, X408: All versions prior to V4.1.0;

• X414 (not previously listed): All versions prior to V3.10.2;

• SITOP PSU8600 PROFINET: All versions prior to V1.2.0,

• SITOP UPS1600 PROFINET (not previously listed): All versions prior to V2.2;

• SIMATIC S7-400 including F and H: All versions prior to V8.2;

SIMATIC Update

This update provides additional information on the advisory that was originally published on February 14^th, 2017. The update provides new information on the affected version:

• SIMATIC WinCC: All versions prior to V7.4 SP1; and

• SIMATIC WinCC Runtime Professional: All versions prior to V14 SP1,

The previously published mitigation measure (SIMATIC Logon V1.5 SP3 Update 2) will work on these products as well.

SICAM PAS Update

This update provides additional information on the advisory that was originally published on December 1^st, 2016. The update provides updated version information and the announcement that the newest version of the software fixes all of the reported vulnerabilities. There is no indication that the researchers have verified the efficacy of the fix.

DROWN Update

This update provides additional information on the advisory that was originally published on April 12^th, 2016 and subsequently updated on February 28^th, 2017. The new update provides updated affected version information for:

• SCALANCE X300 family: All versions prior to V4.1.0,

• SCALANCE X414: All versions prior to V3.10.2,

• SCALANCE X200 RNA family: All versions prior to V3.2.5, and

• ROX I: All versions not using the mitigations listed in SSA-327980 (Siemens link).

Additionally, the update also provides new mitigation information for:

• SCALANCE X300 family;

• SCALANCE X414; and

• ROX I

Missing Siemens Advisories and Updates

The updates published today address five of the six ‘missing updates’ that I discussed on Tuesday. The still missing update is for the Siemens SPIROTEC products; SSA-732541, originally ICSA-15-202-01. I still have not seen the Siemens WannaCry updates that I mentioned on Monday being reported by ICS-CERT. Of course, ICS-CERT could have been waiting for the two new WannaCry updates Siemens announced today (here and here).

ICS-CERT Publishes 3 Advisories

Today the DHS ICS-CERT published three control system security advisories for products from Trihedral and OSIsoft. ICS-CERT continues to have problems with Siemens security advisories and updates.

PI Web API Advisory

This advisory describes cross-site request forgery vulnerability in the OSIsoft Web API. The vulnerability is self-reported. OSIsoft has produced an upgraded version and provides additional mitigation measures.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to access the PI System with the privileges of a legitimate client user (write data).

PI Server Advisory

This advisory describes two improper authentication vulnerabilities in the OSIsoft PI Server. The vulnerability is self-reported. A new version (not currently available) has been developed that mitigates the vulnerability.

ICS-CERT reports that an (uncharacterized skill level) attacker could remotely exploit the vulnerability to spoof a PI Server or cause undefined behavior within the PI Network Manager.

Trihedral Advisory

This advisory describes three vulnerabilities in the Trihedral VTScada product. Karn Ganeshen reported the vulnerability. Trihedral has developed a patch to mitigate the vulnerability. ICS-CERT reports that Ganeshen has verified the efficacy of the fix.

The three reported vulnerabilities are:

• Uncontrolled resource consumption - CVE-2017-6043;

• Cross-site scripting - CVE-2017-6053; and

• Information exposure - CVE-2017-6045

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to result in uncontrolled resource consumption, arbitrary code execution, or information exposure.

NOTE: the VTScada upgrade notes report that “VTScada logo images are now protected by a checksum. VTScada will not start if these files have been removed or modified. If you wish to create a custom-branded application, contact Trihedral Engineering for licensing.” So it is possible that a facility is using a vulnerable system and not know it.

Missing Siemens Advisories and Updates

In addition to the five Siemens’ WannaCry updates I mentioned yesterday, there are six recently reported Siemens’ advisories and updates published that have not been reported by ICS-CERT. They are:

SSA-275839: Denial-of-Service Vulnerability in Industrial Products", June 7^th;

SSA-946325: Vulnerabilities in SICAM PAS, June 9^th;

SSA-732541: Denial-of-Service Vulnerability in SIPROTEC 4, June 12^th;

SSA-293562: Vulnerabilities in Industrial Products, June 13^th;

SSA-623229: DROWN Vulnerability in Industrial Products, June 13^th; and

SSA-931064: Authentication Bypass in SIMATIC Logon, June 13^th

To be fair it is probably too soon to be concerned about the last four, but the other 7 missing Siemens reportings are definite of concern.

As always thanks to the Siemens @ProductCERT for their tweets about security updates on their products.