11 Advisories Published – 12-8-20

Today the CISA NCCIC-ICS published 10 control system security advisories for products from Siemens (6), Schneider (2), Mitsubishi, and multiple vendors. They also published a medical device security advisory for products from GE Healthcare.

NOTE: NCCIC-ICS also published 13 updates (according to an email I received from CISA) for previously published advisories. Interestingly the ICS Archive Information Products web page only currently lists 5 updates. In any case, I will address these updates tomorrow.

LOGO! Advisory

This advisory describes eight vulnerabilities in the Siemens LOGO! 8 BM products. The vulnerabilities were reported by Thomas Meesters from cirosec GmbH, as well as Tobias Gebhardt, and Max Bäumler. Siemens has new versions that mitigate the vulnerability. There is no  indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The eight reported vulnerabilities are:

• Missing authentication for critical function - CVE-2020-25228,

• Use of hard-coded cryptographic key (4) - CVE-2020-25229, CVE-2020-25231, CVE-2020-25233, and CVE-2020-25234,

• Use of a broken or risky cryptographic algorithm (2) - CVE-2020-25230, and CVE-2020-25232, and

• Insufficiently protected credentials - CVE-2020-25235

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker the ability to make configuration and password changes, capture device keys, access confidential information, and gain full control of the device.

SIMATIC Advisory

This advisory describes an uncaught exception vulnerability in the Siemens SIMATIC Controller Web Servers. The vulnerability is self-reported. Siemens has updates that mitigate the vulnerability.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to cause a denial-of-service condition.

TightVNC Advisory

This advisory describes four vulnerabilities in the Siemens SIMATIC products using TightVNC (v1.X), a remote-control software package. TightVNC is an open-source third-party product. The vulnerability was reported by Kaspersky Labs. Siemens has updates for some of the affected products. There is no indication that the researchers have been provided with an opportunity to verify the efficacy of the fix.

The four reported vulnerabilities are:

• Heap-based buffer overflow (2) - CVE-2019-15678, and CVE-2019-15679,

• Null pointer dereference - CVE-2019-15680, and

• Classic buffer overflow - CVE-2019-8287

NOTE: The Kaspersky report identifies vulnerabilities in three other implementations of the VNC protocol; LibVNC, TurboVNC and UltraVNC. Other products (other vendors) with remote access capabilities are going to be affected by these issues. This is going to be a fun one.

SICAM Advisory

This advisory describes a protection mechanism failure vulnerability in the Siemens SICAM A8000 Remote Terminal Unit Series. The vulnerability was reported by Sam Hamra from KTH Royal Institute of Technology. Siemens has a version that mitigates the vulnerability. There is no indication that Hamra has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to gain unauthorized read or write access to network traffic to or from the device.

XHQ Advisory

This advisory describes seven vulnerabilities in the Siemens XHQ Operations Intelligence. The vulnerabilities are self-reported. Siemens has a new version that mitigates the vulnerabilities.

The seven reported vulnerabilities are:

• Exposure of sensitive information to an unauthorized actor - CVE-2019-19283,

• Cross-site scripting - CVE-2019-19284, and CVE-2019-19288,

• Basic XSS - CVE-2019-19285,

• SQL injection - CVE-2019-19286,

• Relative path traversal - CVE-2019-19287, and

• Cross-site request forgery - CVE-2019-19289

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to read sensitive information, modify web content, and perform cross-site scripting and cross-site request forgery on unsuspecting users.

Embedded TCP/IP Stack Advisory

This advisory describes an integer overflow vulnerability in the Siemens SENTRON PAC3200, SENTRON PAC4200, SIRIUS 3RW5 products. This is the third-party Amensia33 vulnerability. The vulnerability was reported by Daniel dos Santos, Stanislav Dashevskyi, Jos Wetzels, and Amine Amri of Forescout Research Labs. Siemens has upgrades available for some of the affected products.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to ause a denial-of-service condition.

Modicon Advisory

This advisory describes five vulnerabilities in the Schneider Modicon M221 Programmable Logic Controller. The vulnerabilities were reported by Yehuda Anikster and Rei Henigman of Claroty, and Seok Min Lim and Bryon Kaan of Trustwave. Schneider has provided generic workarounds to mitigate the vulnerabilities.

The five reported vulnerabilities are:

• Inadequate encryption strength - CVE-2020-7565,

• Small space of random values - CVE-2020-7566,

• Missing encryption of sensitive data - CVE-2020-7567,

• Exposure of sensitive information - CVE-2020-7568, and

• Use of a one-way hash with a predictable salt - CVE-2020-28214

NCCIC-ICS reports that an uncharacterized attacker on an adjacent network could exploit the vulnerabilities to allow an attacker to take control over the PLC and gain unauthorized access, which could result in exposure of sensitive information.

NOTE 1: I briefly reported on the original Schneider advisory back in November. This NCCIC-ICS advisory is based upon an updated version of that advisory published today that adds the last vulnerability reported above.

NOTE 2: The Trustwave report includes proof-of concept exploit code.

Easergy Advisory

This advisory describes five vulnerabilities in the Schneider Easergy T300. The vulnerabilities were reported by Evgeniy Druzhinin and IIya Karpov of Rostelecom-Solar. Schneider has a new version that mitigates the vulnerabilities. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Missing authentication for critical function - CVE-2020-7561,

• Missing authorization - CVE-2020-28215,

• Missing encryption of sensitive data (2) - CVE-2020-28216, and CVE-2020-28217, and

• Improper restriction of rendered UI layers or frames - CVE-2020-28218

NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerabilities to obtain unauthorized access to the internal product LAN, which could result in exposure of sensitive information, denial of service, and remote code execution when access to a resource from an attacker is not restricted or incorrectly restricted.

NOTE: I briefly reported on the original Schneider advisory back in November. This NCCIC-ICS advisory is based upon an updated version of that advisory published today that adds the last four vulnerabilities reported above.

NOTE: Schneider also published nine new advisories and three additional updates today. I suspect that I will be addressing these this weekend.

Mitsubishi Advisory

This advisory describes an out-of-bounds read vulnerability in the Mitsubishi GOT and Tension Controller. The vulnerability is self-reported. Mitsubishi is providing generic mitigation measures while it continues to work on a fixed version of the products.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause deterioration of communication performance or cause a denial-of-service condition of the TCP communication functions of the products.

NOTE: I briefly reported on this vulnerability last weekend.

Embedded TCP/IP Stacks Advisory

This advisory discusses the Amnesia33 vulnerabilities that were briefly addressed in the Siemens TCP/IP advisory above. This separate advisory lists 33 distinct vulnerabilities (thus the ‘33’ in the title of the Forescout report) found in the different TCP/IP stack implementations. It also provides a list of vendor advisories for products affected by these vulnerabilities:

• Devolo

• EMU Electronic AG

• FEIG

• Genetec

• Harting

• Hensoldt

• Microchip

• Nanotec

• NT-Ware

• Tagmaster

• Siemens

• Uniflow

• Yanzi Networks

It is interesting that NCCIC-ICS published a separate advisory for the Siemens version of the vulnerability.

GE Advisory

This advisory describes two vulnerabilities in the GE Imaging and Ultrasound Products. The vulnerabilities were reported by Lior Bar Yosef and Elad Luz of CyberMDX. GE has publicly provided generic workarounds to mitigate the vulnerabilities.

The two reported vulnerabilities are:

• Unprotected transport of credentials - CVE-2020-25175, and

• Exposure of sensitive system information to an unauthorized control sphere - CVE-2020-25179

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow an attacker to gain access to affected devices in a way that is comparable with GE (remote) service user privileges. A successful exploitation could expose sensitive data such as a limited set of patient health information (PHI) or could allow the attacker to run arbitrary code, which might impact the availability of the system and allow manipulation of PHI.

3 Advisories Published – 11-3-20

Today the CISA NCCIC-ICS published three control system security advisories for products from ARC Informatique, NEXCOM, and WAGO.

ARC Advisory

This advisory describes three vulnerabilities in the ARC PcVue. The vulnerabilities were reported by Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab. ARC has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Deserialization of untrusted data - CVE-2020-26867,

• Access to critical private variable via public method - CVE-2020-26868, and

• Information exposure of sensitive information to an unauthorized actor - CVE-2020-26869

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to execute arbitrary code, expose sensitive data, and prevent legitimate users from connecting to PcVue services.

NEXCOM Advisory

This advisory describes two vulnerabilities in the NEXCOM NIO 50 IoT Gateway. The vulnerabilities were reported by the Zero Day Initiative. NEXCOM no longer supports the NIO 50 product.

The two reported vulnerabilities are:

• Improper input validation - CVE-2020-25151, and

• Cleartext transmission of sensitive information - CVE-2020-25155

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to view sensitive information and cause a denial-of-service condition due to improper input validation.

WAGO Advisory

This advisory describes an uncontrolled resource consumption vulnerability. This vulnerability was reported by William Knowles of Applied Risk. WAGO has new firmware that mitigates the vulnerability. There is no indication that Knowles has been provided an opportunity to verify the efficacy of the fix.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to crash the device being accessed using a denial-of-service attack.

NOTE 1: I briefly discussed this vulnerability last Saturday.

NOTE 2: The researcher acknowledgement section of this advisory is a little confusing. William Knowles of Applied Risk reported the vulnerability via CERT@VDE.

Public ICS Disclosure – Week of 4-18-20

This week we have 8 vendor advisories for products from ABB (4), Johnson Controls, Rockwell, BD and Eaton; as well as 3 updated advisories for products from ABB. There are also 3 researcher disclosures for products from P5, Rockwell and Siemens.

ABB Advisories

ABB published an advisory describing a path traversal vulnerability in their UPS Adapter CS141. The vulnerability was reported by Eduardo Cataño Conde. ABB has a new version that mitigates the vulnerability. There is no indication that Conde has been provided an opportunity to verify the efficacy of the fix.

ABB published an advisory describing five vulnerabilities in their ABB Central Licensing System. The vulnerabilities were reported by William Knowles at Applied Risk. ABB will be preparing product specific advisories for these vulnerabilities.

The five reported vulnerabilities are:

• Information disclosure - CVE-2020-8481;

• XML external entity injection - CVE-2020-8479;

• Denial of service - CVE-2020-8475;

• Privilege elevation - CVE-2020-8476; and

• Weak file permissions - CVE-2020-8471

ABB published an advisory describing the impact of their Central Licensing System Vulnerabilities (see above) on their System 800xA, Compact HMI and Control Builder Safe products. A new version of the Central Licensing System is available that mitigates some of the vulnerabilities. There is no indication that Knowles has been provided an opportunity to verify the efficacy of the fix.

ABB published an advisory describing Inter process communication vulnerability in System 800xA. The vulnerabilities were reported by William Knowles at Applied Risk. ABB has provided generic workarounds to mitigate the vulnerability while working on product updates. NOTE: ABB has requested separate CVE numbers for each affected product based upon varying levels of risk in the products.

NOTE: The ABB Alerts and Notifications page also lists two advisories for products from B&R. I have not covered them here because they were covered when they were released by B&R.

Johnson Controls Advisory

Johnson Controls published an advisory describing an XML external entity injection vulnerability in their BCPro Workstation and Building Configuration Tool (BCT) software. The vulnerability is self-reported. Johnson Controls has a patch that mitigates the vulnerability.

Rockwell Advisory

Rockwell published an advisory describing eight third-party vulnerabilities in their FactoryTalk product. The vulnerabilities are in the Gemalto Sentinal LDK Runtime Environment. The Sentinal LDK vulnerabilities were reported by Kaspersky in January of 2018. Rockwell has a new version that mitigates the vulnerabilities.

BD Advisory

BD published an advisory describing a third-party vendor outdated certificate vulnerability in a large number of their products. The problem was identified by ESET in some of their legacy products. BD is working on validating the ESET update.

Eaton Advisory

Eaton published an advisory describing a third-party vendor stack-based buffer overflow vulnerability in their products  supporting DNP3 Protocol. The Triangle MicroWorks vulnerability was reported by NCCIC-ICS (ICSA-20-105-02) last week. Eaton provided generic workarounds while it is evaluating the vulnerability and its effects on their products.

ABB Updates

ABB published an update for their System 800xA Weak File Permissions advisory that was originally published on April 2^nd, 2020. The new information includes an added FAQ question on functional safety.

ABB published an update for their System 800xA Information Manager advisory that was originally published on April 2^nd, 2020. The new information includes an added FAQ question on functional safety. (NOTE: includes statement that: “Under certain conditions exploits of this vulnerability may affect the integrity of safety functions in System 800xA.”)

ABB published an update for their System 800xA Weak Registry Permissions advisory that was originally published on April 2^nd, 2020. NOTE: The ABB Alerts and Notifications page says that this advisory was updated on “2020-04-21” like the previous 2, but the link takes one to the original advisory with no changes. I suspect that the update should include the same added FAQ question seen in the two updates described above. The difference would be in the answer to that FAQ.

Researcher Disclosures

Zero Science published a report describing a stored cross-site scripting vulnerability in the P5 FNIP-8x16A eight channel relay module. The report includes links to an exploit published by LiquidWorm. Zero Science has attempted to contact P5 but has received no response.

Applied Risk published a report describing an insecure registry permissions vulnerability in the Rockwell RSLinx Classic. This vulnerability was reported by NCCIC-ICS on April 9^th, 2020.

Applied Risk published a report describing an insecure file permissions vulnerability in the Siemens TIA Portal. This vulnerability was reported by NCCIC-ICS on January 14^th, 2020 and subsequently updated on April 14^th.

Public ICS Disclosures – Week of 08-10-19

This week we have eight vendor notifications from Schneider (7) and Siemens; updates for four previouls published advisories from Schneider (2) and Siemens (2); as well as two exploit reports for previously published vulnerabilities in products from Wind River, and Cisco.

Schneider Advisories

Magelis Advisory

Schneider published an advisory describing an improper check for unusual or exceptional conditions vulnerability in their Magelis HMI Panel products. The vulnerability was reported by VAPT Team. Schneider provides generic workarounds to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Modicon 340 Advisory

Schneider published an advisory describing an improper check for unusual or exceptional conditions vulnerability in their Modicon M340 controllers. The vulnerability was reported by VAPT Team. Schneider provides generic workarounds to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

Modicon Advisory

Schneider published an advisory describing three improper check for unusual or exceptional conditions vulnerabilities in their Modicon Ethernet / Serial RTU Modules. The vulnerability was reported by VAPT Team. Schneider provides generic workarounds to mitigate the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

SoMachine Advisory

Schneider published an advisory describing an untrusted search path vulnerability in their SoMachine HVAC. The vulnerability was reported by Yongjun Liu of the nsfocus security team. Schneider has a new version that mitigates the vulnerability. There is no indiction that Yonguin has been provided an opportunity to verify the efficacy of the fix.

TelevisGo Advisory

Schneider published an advisory describing 22 vulnerabilities in the third party UltraVNC (remote accesss) software component embedded within the TelevisGo product. The vulnerabilities were reported by Kaspersky Labs. Schneider has a hot-fix available that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The 22 reported vulnerabilities are:

• Buffer errors (9) - CVE-2019-8258, CVE-2018-15361, CVE-2019-8262, CVE-2019-8263, CVE-2019-8269, CVE-2019-8271, CVE-2019-8273, CVE-2019-8274, and CVE-2019-8276;

• Resource management errors (2) - CVE-2019-8259, and CVE-2019-8277;

• Out-of-bounds read (8) - CVE-2019-8260, CVE-2019-8261, CVE-2019-8280, CVE-2019-8264, CVE-2019-8265, CVE-2019-8266, CVE-2019-8267, and CVE-2019-8270;

• Incorrect calculation (2) - CVE-2019-8268, CVE-2019-8272; and

• Improper access control - CVE-2019-8275.

Software Update Service Advisory

Schneider published an advisory describing a deserialization of trusted data vulnerability in their Software Update (SESU) SUT Service. The vulnerability was reported by Amir Preminger of Claroty. Schneider has a new version that mitigates the vulnerability. There is no indication that Preminger has been provided an opportunity to verify the efficacy of the fix.

spaceLYnk Advisory

Schneider published an advisory describing an authentication vulnerability in their  spaceLYnk and Wiser for KNX controllers. The vulnerability was reported by Sumedt Jitpukdebodin. Schneider has new versions that mitigate the vulnreabilty. There is no indication that Jitpukdebodin has been provided an opportunity to verify the efficacy of the fix.

Schneider Updates

Modicon Controllers Update

Schneider published an update that was originally published on May 14^th, 2019.  New information includes:

Added mitigation measures for M340;

Added four new vulnerabilities (links for reports w/exploits from Talos):

• Denial of service vulnerability - CVE-2019-6809;

• Denial of service vulnerability - CVE-2019-6828;

• Denial of service vulnerability - CVE-2019-6829; and

• Denial of service vulnerability - CVE-2019-6830

SCADAPack Update

Schneider published an update for an advisory that was originally published on May 24^th, 2017. New information includes:

• Updated researcher acknowledgement section;

• Corrected CVE ID from CVE-2017-6028 to CVE-2017-6034; and

• Corrected vulnerability description

Siemens Advisory

Siemens published an advisory describing two vulnerabilities in their SIMATIC S7-1200 and SIMATIC

S7-1500 CPU families.  The vulnerabilities were reported by Eli Biham, Sara Bitan, Aviad Carmel, and Alon Dankner, Uriel Malin, and Avishai Woo. Siemens has generic workarounds that mitigate the vulenrabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Man-in-the-middle vulnerability - CVE-2019-10929; and

• Code change vulnerability - CVE-2019-10943

Siemens Updates

ZombieLoad Update

Siemens published an update for an advisory that was originally published on July 9^th, 2019. New information includes:

• SIMATIC IPCs 427D, 477D, 627D, 627E, 647D, 647E, 677D, 677E, 827D, 847D, 847E; and

• FieldPG M6

GNU/Linux Update

Siemens published an update for an advisory that was originally published on November 27^th, 2019. New information includes:

• Added CVE-2018-19591, CVE-2019-11360, CVE-2019-13272; and

• Moved CVE2018-16862 from buildtime to runtime relevant

Cisco Exploit

Angelo Ruwantha published a Metasploit module for a vulnerability in the Cisco Adaptive Security Appliance; Cisco published an advisory on this vulnerability on June 6thy, 2018. NCCIC-ICS published an advisory for Rockwell Automation Allen-Bradley Stratix 5950 listing this vulnerability.

WindRiver (Urgent/11) Exploit

Zhou Yu published an exploit for an integer overflow vulnerability in the Wind River VxWorks (one of the Urgent/11 vulnerabilities).

ICS-CERT Publishes 2 Advisories and 4 Updates

Yesterday the DHS ICS-CERT published a control system security advisory for products from Lantech. They also published a medical device security advisory for products from Philips. Additionally, they updated four previously published security advisories for products from Siemens (2), Nari, and Schneider.

Lantech Advisory

This advisory describes two vulnerabilities in the Lantech IDS 2102 Ethernet device server. The vulnerabilities were reported by Florian Adamsky. Lantech has not responded to ICS-CERT on these vulnerabilities.

The two reported vulnerabilities are:

• Improper input validation - CVE-2018-8869; and

• Stack-based buffer overflow - CVE-2018-8865

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to execute arbitrary code on the system through crafting malicious input.

Philips Advisory

This advisory describes three vulnerabilities in the Philips Brilliance CT Scanners. These vulnerabilities were self-reported. Philips has a new version that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Execution with unnecessary privilege - CVE-2018-8853;

• Exposure of resources to the wrong sphere - CVE-2018-8861; and

• Use of hard-coded credentials - CVE-2018-8857

ICS-CERT reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to execute software or to view/update files including patient health information (PHI), directories, or system configuration.

NOTE: These vulnerabilities were not reported on the FDA Medical Device Safety Communications web site.

PROFINET Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th,  November 28^th, 2017, January 18^th, 2018, January 25^th, 2018, January 27^th, 2018 and most recently on March 6^th, 2018. The new information includes updated version information and links to new versions for:

• SIMATIC CP 343-1 Std; and

• CP 343-1 Lean

Industrial Products Update

This update provides additional information on an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th, November 28^th and most recently February 27^th, 2018. The new information includes updated version information and links to new versions for:

• SINAMICS G130;

• SINAMICS G150;

• SINAMICS S120; and

• SINAMICS S150

These two updates were published yesterday by Siemens. Siemens also announced three new advisories (here, here, and here) and one additional update (here). I suspect that ICS-CERT will publish their advisories and updates next week.

Nari Update

This update provides additional information on an advisory that was originally published on January 25^th, 2018. Nari has released a new version that mitigates the vulnerability. There is no indication that the researchers from Kaspersky labs that initially reported the vulnerability have been provided an opportunity to verify the efficacy of the fix. When ICS-CERT published their initial report they had received no response from Nari.

Schneider Update

This update provides additional information on an advisory that was originally published on April 17^th, 2018. The new information includes:

• Revises attacker characterization (now “high skill level”);

• Changed CVSS base score to 9.0 (from 10.0) and the CVSS vector string for vulnerability #1;

• Changed the CVSS vector string for vulnerability #2; and

• Completely re-wrote mitigations section to include links to Schneider advisory and ICS-CERT Yara rule

Public ICS Disclosures – Week of 04-14-18

This week we have four new vendor reported vulnerabilities (all from ABB) and two vendor updates of previously disclosed vulnerabilities (both from Siemens).

Industrial Products Spectre and Meltdown Update

This update provides new mitigation information (for SIMATIC IPC427D, SIMATIC IPC477D, SIMATIC FieldPG M4) on the previously reported Spectre and Meltdown vulnerabilities in Siemens Industrial Products. The Industrial Products vulnerability was reported in the ICS-CERT Meltdown and Spectre Vulnerabilities Alert, but ICS-CERT does not issue an update for multivendor products when listed product advisories are updated.

To be fair, the link in the latest version of the ICS-CERT alert does take you to the latest version of the Siemens advisory, but you have no way of knowing that new information is available just by looking at the ICS-CERT alert. This is an ongoing issue for all ICS-CERT alerts/advisories covering multiple vendor vulnerabilities.

SIMATIC Denial of Service Vulnerability Update

This update provides new mitigation information (for SIMATIC BATCH V8.0 and V8.1) on the previously reported denial of service vulnerability in the Siemens SIMATIC product line. I am not sure why ICS-CERT did not update their advisory for this product on Thursday when they updated the SIMATIC IPC advisory that was released the same day.

Relion 630 Series Advisory #1

This advisory describes a weak database encryption vulnerability in the ABB Relion 630 Series relays. This vulnerability was privately reported to ABB. ABB has no plans of corrective measures for this specific issue in the affected products.

ABB reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to delete or modify the database. Removing or modifying the database will make the device inoperable. ABB notes that the database contains cross reference data for faster indexing and searching and does not contain any secret information.

Relion 630 Series Advisory #2

This advisory describes a path traversal vulnerability in the IEC 61850 Manufacturing Message Specification (MMS) implementation in the ABB Relion 630 Series relays. The vulnerability was privately reported to ABB. ABB has new versions that mitigate the vulnerability.

ABB reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to retrieve any file on the device’s flash drive without authentication on the device or make the product inoperative by deleting files from the device’s flash drive.

It is not clear if this is a problem that is unique to ABB implementation of the IEC 61850 MMS or whether it may apply to other vendor devices as well.

Relion 630 Series Advisory #3

This advisory describes a terminal reboot vulnerability in the SPA communications protocol in the ABB Relion 630 Series relays. The vulnerability was privately reported to ABB. ABB has new versions that mitigate the vulnerability.

ABB reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to reboot the device resulting in a denial of service situation. During the reboot phase, the primary functionality of the device is not available.

PCM600 and SAB600 Advisory

This advisory describes multiple vulnerabilities in the Sentinel HASP Run‐time Environment in the ABB PCM600 and SAB600 substation management devices. These vulnerabilities are apparently the Gemalto license management problems reported by Kaspersky Labs; ABB is reporting only four of the fourteen Gemalto vulnerabilities. ABB has new versions that mitigate the vulnerabilities.

ABB reports that an uncharacterized attacker with uncharacterized access could exploit the vulnerability to cause a buffer overflow. Buffer overflows may allow remote attackers to execute arbitrary code or to shut down the remote process (a denial of service).

OMB Receives Anti-Kaspersky FAR Rule for Review

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received for review an interim final rule for a Federal Acquisition Regulation (FAR) for the use of products or services from the Kaspersky Labs. This rulemaking was not included in the Fall 2017 Unified Agenda.

This is probably a rule implementing the requirements of §1634 of HR 2810, the National Defense Authorization Act for Fiscal Year 2018. That bill was signed into law on December 12^th, 2017 (PL 115-91, not yet printed); which would explain why this rule did not make the last Unified Agenda.

That section would prohibit any “department, agency, organization, or other element of the Federal Government” from using “any hardware, software, or services developed or provided, in whole or in part, by” {§1634(a)} Kaspersky Labs. The effective date of that prohibition is October 1^st, 2018 which is undoubtedly the reason for going the ‘interim final rule’ route.

ICS-CERT Publishes Siemens Advisory

Yesterday the DHS ICS-CERT published a control system advisory for products from Siemens. These are the vulnerabilities I reported on Saturday.

This advisory describes eight vulnerabilities in the Siemens Building Technologies Products. These are Gemalto Sentinel LDK RTE vulnerabilities that have been previously reported by Siemens in other products. The vulnerabilities were reported by Sergey Temnikov and Vladimir Dashchenko from Kaspersky Labs. Siemens has a newer version of the License Management System (LMS) that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The eight reported vulnerabilities are:

• Stack-based buffer overflow (2) - CVE-2017-11496, CVE-2017-11497;

• Security features - CVE-2017-12819;

• Improper restriction of operations within the bounds of a memory buffer - CVE-2017-12821;

• Null pointer dereference - CVE-2017-11498;

• XML entity expansion - CVE-2017-12818;

• Heap-based buffer overflow - CVE-2017-12820; and

• Improper access control - CVE-2017-12822

Again, Siemens is not reporting all 14 of the Gemalto vulnerabilities. I would suspect that this is because the Siemens implementation of the license manager does not include the features affected by the other vulnerabilities.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to allow arbitrary code execution, NTLM-relay attacks, denial of service of the remote process, remote denial of service, and/or allow the administrative interface to be remotely enabled and disabled without authentication.

NOTE: Siemens announced that it had updated this advisory yesterday. The update includes a link to download the LMS.

ICS-CERT Published 3 Advisories and Update the Meltdown Alert

Today the DHS ICS-CERT published three new control system security advisories for products from Delta Industrial Automation, Moxa and Siemens. They also updated the previously published alert for the Meltdown and Spectre chip vulnerabilities.

Delta Advisory

This advisory describes a stack-based buffer overflow vulnerability in the Delta DOPSoft human machine interface. The vulnerability was reported by Ghirmay Desta via the Zero Day Initiative. Delta has a new version that mitigates the vulnerability. There is no indication that Desta has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause the device the attacker is accessing to crash; a buffer overflow condition may allow remote code execution.

Moxa Advisory

This advisory describes three vulnerabilities in the Moxa OnCell high-speed industrial-grade IP gateway. The vulnerabilities were reported by Kirill Nesterov, Eugenie Potseluevskaya, and Radu Motspan of Kaspersky Labs. Moxa has released a new firmware version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Reliance on cookies without validation and integrity checking - CVE-2018-5455;

• Improper handling of length parameter inconsistency - CVE-2018-5453; and

• Null pointer dereference - CVE-2018-5449

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability  to remotely execute code on the device.

Siemens Advisory

This advisory describes multiple vulnerabilities in the Siemens SIMATIC, SIMOTION, and SINUMERIK industrial computers. These vulnerabilities were self-reported by Siemens. The Siemens security advisory reports that these are 3^rd party vulnerabilities in the Intel Management Engine (ME), Intel Server Platform Services (SPS), and Intel Trusted Execution Engine (TXE)

The eight reported vulnerabilities are:

• Stack-based buffer overflow (5) - CVE-2017-5705, CVE-2017-5706, CVE-2017-5707, CVE-2017-5712, and CVE-2017-5711; and

• Permissions, privileges, and access controls (3) - CVE-2017-5708, CVE-2017-5709, and CVE-2017-5710

ICS-CERT reports that a relatively low-skilled attacker could remotely (some of the vulnerabilities require local access) to execute arbitrary code or gain unauthenticated access to sensitive data.

NOTE: Again, with 3^rd party vulnerabilities one has to wonder what other systems will be affected. But, since Intel is such a small company (right) it is unlikely that any other vendors will use this vulnerable code (pardon the sarcasm).

Meltdown Update

This update provides additional information on an alert that was originally published on January 11^th, 2018 and updated on January 16^th, 2018, January 17^th, 2018, January 30^th, 2018, February 20^th, 2018, and again on February 22^nd, 2018.

The advisory provides links to new vendor reports on the vulnerabilities:

• Dräger;

• Pepperl+Fuchs; and

• Yokogawa Electric Corporation

ICS-CERT Publishes 4 Advisories and One ABB Update

Today the DHS ICS-CERT published four new control system security advisories for products from Schneider Electric (2), GE and Nortek. Additionally, they provided an update for a previously published advisory for products from ABB.

StructureOn Advisory

This advisory describes an unrestricted upload of file with dangerous type vulnerability in the Schneider StruxureOn Gateway software management program. The vulnerability is being self-reported.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to upload a malicious file to any directory on the device, which could lead to remote code execution. The Schneider security advisory reports that the file must be a .zip file with specifically modified metadata for this vulnerability to be exploited.

IGSS Mobile Advisory

This advisory describes two vulnerabilities in the Schneider IGSS Mobile application (iOS and Android). The vulnerabilities were reported by Alexander Bolshev (IOActive) and Ivan Yushkevich (Embedi). Schneider has produced updates for both versions. There is no indication that either researcher has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper certificate validation - CVE-2017-9968; and

• Plaintext storage of password - CVE-2017-9969

ICS-CERT reports that a relatively low-skilled attacker with local access (okay they, actually said: “Locally exploitable”; that may not mean ‘local access’) could exploit the vulnerability to execute a man-in-the-middle attack. In addition, passwords can be accessed by unauthorized users.

NOTE: Marc Ayala pointed out to me that anyone can download these apps from the appropriate (iOs/Android) app store. This means that it would be easy to exploit a compromised mobile password. All the attacker needs to do is to get access to the IGSS configuration file on an oh so secure smart phone to compromise the password.

GE Advisory

This advisory describes two vulnerabilities in the GE D60 Line Distance Relay. The vulnerabilities were reported by Kirill Nesterov of Kaspersky Labs. GE has released new firmware that mitigates the vulnerability. There is no indication that Nesterov was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2018-5475; and

• Improper restriction of operations within bounds of memory buffer - CVE-2018-5473

ICS-CERT reports that relatively low-skilled attacker could remotely exploit the vulnerability to execute arbitrary code on the device.

Nortek Advisory

This advisory describes a command injection vulnerability in the Nortek Linear eMerge E3 Series access control interface. The vulnerability was reported by Evgeny Ermakov and Sergey Gordeychik. Nortek recommends upgrading the system using established procedures. There is no indication that either researcher was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability  to execute malicious code on the system with elevated privileges, allowing for full control of the server.

ABB Update

This update provides additional information on an advisory that was originally published on November 14^th, 2017. The update reports that the new update of Mesh OS mitigates the KRACK vulnerability in these devices.

NOTE: The updated ABB security advisory that forms the basis for this ICS-CERT update was published on January 11^th, 2018.

ICS-CERT Publishes 3 Advisories and 1 Update

Yesterday the DHS ICS-CERT published three control system security advisories for products from Gemalto, Smart Software Solutions (3S), and Fuji Electric. They also updated a previously published control system security advisory for products from NXP Semiconductor.

Gemalto Advisory

This advisory describes multiple vulnerabilities in the Gemalto Sentinel License Manager. The vulnerabilities were reported by Kaspersky Labs. The latest version of the software mitigates the vulnerability. There is no indication that Kaspersky Labs has been provided an opportunity to verify the efficacy of the fix.

The seven reported vulnerabilities are:

• Null pointer dereference - CVE-2017-11498;

• Stack-based buffer overflow (4) - CVE-2017-11497, CVE-2017-11496, CVE-2017-12818 and CVE-2017-12821;

• Heap-based buffer overflow - CVE-2017-12820; and

• Improper access control - CVE-2017-12822

NOTE: This is essentially the same vulnerability that I have discussed previously (here and here). The Kaspersky article on this problem actually list 14 vulnerabilities not the seven being reported here. I mentioned earlier that there may be as many as 40,000 products (not all being ICS, obviously) being affected by this issue. If the Gemalto dongle is clearly identified as being a ‘Sentinel License Manager’, then this advisory is clearly a much more effective means of addressing the issue rather than issuing advisories on each of the affected product lines. If the using vendors, however, have relabeled their dongles, then this advisory will not be effective in those cases. But that is not ICS-CERT’s fault.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities and that could lead to remote code execution or cause a denial-of-service condition, rendering the Sentinel LDK License Manager service unavailable (and the supported product also being unavailable).

3S Advisory

This advisory describes a stack-based buffer overflow in the 3S CODESYS Web Server. The vulnerability was reported by Zhu WenZhe of Istury IOT security lab. 3S has released a security patch to mitigate this vulnerability. There is no indication that Zhu was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability causing the device to crash, resulting in a buffer overflow condition that may allow remote code execution.

Fuji Advisory

This advisory describes a stack-based buffer overflow vulnerability in the Fuji V-Server VPR. The vulnerability was reported by Ariele Caltabiano (kimiya) via the Zero Day Intitiative. Fuji has produced a new firmware version that mitigates the vulnerability. There is no indication that Caltabiano has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability  to view sensitive information and disrupt the availability of the device.

NXP Update

This update provides new information for an advisory that was originally published on October 12^th, 2017. The update provides links to the new version of the single remaining product that was not previously fixed.

ICS-CERT Publishes 3 Advisories and 5 Siemens Updates

Today the DHS ICS-CERT published two control system security advisories for products from Siemens and Nari as well as a medical control system security advisory for products from Philips. They also updated five control system security advisories from Siemens.

Philips Advisory

This advisory describes an insufficient session expiration advisory for the Philips IntelliSpace Cardiovascular cardiac image and information management systems. According to the Philips product security page this vulnerability was identified based upon a customer submitted complaint. Philips plans on releasing an updated version to mitigate the vulnerability.

ICS-CERT reports that a relatively low-skilled attacker with local access could exploit the vulnerability  to gain unauthorized access to sensitive information stored on the system and modify this information.

NOTE: This vulnerability was not reported on the FDA medical device safety communications page, probably because an exploit would only reveal personally identifiable information making this more of a HIPAA problem. Unfortunately, I cannot find (after an admittedly brief search) a software vulnerability reporting page on the HHS HIPAA site.

Siemens Advisory

This advisory describes an improper authentication vulnerability in the Siemens Desigo PXC. The vulnerability was reported by Can Demirel and Melih Berk Eksioglu from Biznet Bilisim. Siemens has provided an updated version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit this vulnerability to  allow unauthenticated remote attackers to upload malicious firmware without prior authentication.

BTW: Siemens tweeted this morning about another new advisory that they have just published. That will probably show up next week on the ICS-CERT site.

Nari Advisory

This advisory describes an improper input validation vulnerability in the Nari PCS-9611 relay, a control and monitoring unit. The vulnerability was reported by Kirill Nesterov and Alexey Osipov from Kaspersky Labs. Nari has not responded to ICS-CERT about this reported vulnerability.

ICS-CERT reports that a relatively low-skilled attacker could use a publicly available exploit to remotely exploit the vulnerability to gain arbitrary read/write abilities on the system.

Industrial Products (older advisory) Update

This update provides new information for an advisory that was advisory originally issued on November 8, 2016 and then updated November 22^nd, 2016; December 23^rd, 2016; February 14^th, 2017; March 2^nd, 2017,  May 9^th, 2017, and again on June 20^th, 2017. The new information includes new affected version data and mitigation links for:

• SINEMA Remote Connect Client: All versions prior to V1.0 SP3;

NOTE: The revised Siemens security notice also changed the temporary mitigation measures for SIMATIC PCS 7 V8.1, but that was not mentioned in the ICS-CERT update.

S7-300 Update

This update provides new information for an advisory that was originally published on December 13^th, 2016 and then updated on May 9^th, 2017, July 25^th, 2017, and again on November 28^th, 2017. The new information includes the addition of two new affected products along with mitigation links:

• SIMATIC S7-400 V7 CPU family; and

• SIMATIC S7-410 V8 CPU family

NOTE: The revised Siemens security notice reports that the S7-410 V8 CPU family is only affected by the inadequate encryption strength vulnerability.

PROFINET Update

This update provides new information for an advisory that was originally published on May 9^th, 2017 and updated on June 15, 2017,on July 25^th, 2017, on August 17^th, 2017, on October 10^th, on November 14^th,  November 28^th, 2017, and most recently January 18^th, 2018. The new information includes new affected version data and mitigation links for:

• S7-400 PN/DP V7 Incl. F: All versions prior to V7.0.2

• SINAMICS DCP w. PN: All versions prior to V1.2 HF 1

SCALANCE Update

This update provides new information for an advisory that was originally published on November 14^th, 2017 and updated on December 5^th, 2017, and again on December 19^th, 2017. The new information includes new affected version data and mitigation links for:

• SCALANCE WLC711: All versions prior to V9.21.19.003; and

• SCALANCE WLC712: All versions prior to V9.21.19.003

Industrial Products (newer advisory) Update

This update provides new information for an advisory that was originally published on December 5th, 2017 and updated on December 19th, 2017 and again on January 23^rd, 2018. The new information includes new affected version data and mitigation links for:

• SIMATIC S7-400 PN/DP V7: All versions prior to V7.0.2; and

• SIMATIC ET 200MP: All versions prior to V4.0.2

Commentary

Even if Siemens does not issue any more multiple product advisories in the near future (not likely, they have obviously shared a bunch of code across product lines over the years) we will continue to see large numbers of these advisory updates over the next year or so. Unfortunately, while vulnerable code is relatively easy to share, fixes cannot be cut and pasted so easily; too many dependencies, loops, etc. to check and modify as necessary. These time and resource-consuming exercises being undertaken by Siemens are a good example of why secure coding practices are so important; it really is easier over the life of the product to do it right the first time.

It would really be a good cybersecurity grad-student project to look at the costs that Siemens is expending to go back and correct mistakes that should have been caught before they ever made it to market.

ICS-CERT Publishes Two Advisories

Yesterday the DHS ICS-CERT published two control system security advisories for products from Advantech and Siemens.

Advantech Advisory

This advisory describes two vulnerabilities in the Advantech WebAccess HMI platform. The vulnerabilities were reported by Steven Seeley via the Zero Day Initiative. Advantech released a new version to mitigate the vulnerability. There is no indication that Seeley has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2017-14016; and

• Untrusted pointer dereference - CVE-2017-12719

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to allow remote code execution.

Siemens Advisory

This advisory describes an improper input validation vulnerability in the Siemens SIMATIC PCS7 distributed control system. The vulnerability was reported by Sergey Temnikov and Vladimir Dashchenko of Kaspersky Labs. Siemens has issued an update for some versions to mitigate the vulnerability. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix. Siemens has provided interim mitigation suggestions pending updates to the other versions.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to crash services on the device. The Siemens security advisory reports that: “The attacker must be member of the group administrators and have network access to an affected system.”

NOTE: Siemens reported this vulnerability on October 18^th.