ICS-CERT Updates NTP Advisory

Today the DHS ICS-CERT updated their advisory for the previously reported set of vulnerabilities in the Network Time Protocol Daemon. It is a rather unusual update in that the previous version reported that there were publicly available exploits and the new version claims that there are no known publicly available exploits. The CERT-CC notice also currently says that there are no known exploits available (I didn’t save a copy of their original report so I can’t tell if it changed).

The NTP advisory does not address the issue at all.

BTW #1: I missed it last week, but NTP web site is (has been) reporting that two of these vulnerabilities were fixed quite some time ago (2010 for the weak default key, and 2011 for the weak random number generator). I guess you just fix some things without knowing that they need fixing.

BTW #2: The NTP web site is (has been) reporting that there are two other, as of yet unspecified vulnerabilities in the NTP that have yet to be fixed. They expect to fix them within the next month.

ICS-CERT Publishes NTP Advisory

This morning the DHS ICS-CERT published an advisory concerning multiple vulnerabilities in the Network Time Protocol (NTP) reported by Neel Mehta and Stephen Roettger from the Google Security Team. A newer version of the protocol (NTP-4.2.8) is not affected by these vulnerabilities. The identified vulnerabilities include:

• Insufficient entropy - CVE-2014-9293;

• Use of cryptographically weak PNRG - CVE-2014-9294;

• Stack based buffer overflows - CVE-2014-9295; and

• Missing return on error - CVE-2014-9296

According to the NTP.org security notice on these vulnerabilities there are actually three different buffer stack overflows covered in the reported CVE: in crypto_recv(), in ctl_putdata(), and configure().

ICS-CERT reports that a relatively unskilled attacker could use the publicly available exploits to execute malicious code. They also report that “NTP is widely used within operational Industrial Control Systems deployments”.

The CERT-CC vulnerability notice for these vulnerabilities is starting to list various vendors and their status vis a vi these vulnerabilities. Unfortunately there are no purely ICS vendors currently on their list. It would be nice if ICS-CERT attempted to do the same specifically for control system vendors.

ICS-CERT Publishes 4 Advisories

Today the DHS ICS-CERT published four advisories for vulnerabilities in control systems. Three were product specific for systems from Siemens, Mitsubishi and Iconics. One was for an open source protocol used by multiple vendors. Two of the advisories were initiated by ICS-CERT, one by a team of Malaysian researchers in a coordinated disclosure, and one by an anonymous researcher in an uncoordinated disclosure.

Iconics Advisory

This advisory was initiated by ICS-CERT (needless to say in a coordinated disclosure) after discovering the vulnerability during an investigation concerning an unrelated product. This is an insecure ActiveX vulnerability in the GENESIS32 system. Interestingly the advisory never states that Iconics has produced a patch or upgrade for this vulnerability.

ICS-CERT reports that a moderately skilled attacker could exploit this vulnerability remotely, but nature of the vulnerability would require an authorized user to visit a specially crafted web site first. A successful exploitation could lead to the execution of arbitrary code.

An Iconics security document (that lists all 8 ICS-CERT Iconics’ advisories) reports that a patch has been developed and ICS-CERT is in the process of validating its efficacy. It also notes that the IcoLaunch.dll can be accessed via command line.

Mitsubishi Advisory

This advisory is also about an ActiveX vulnerability, this time in the McWorX application. The uncoordinated disclosure by Blake included proof-of-concept code was reported in an earlier ICS-CERT Alert. A patch is available for the affected version and newer versions do not include this vulnerability.

ICS-CERT reports that a moderately skilled attacker could use the publicly available exploit code to remotely exploit this vulnerability to execute arbitrary code.

The Mitsubishi patch download page explains that the patch loads a new version of IcoLaunch.dll, the same file that was a problem in the Iconics vulnerability. It would seem that ICS-CERT discovered the Iconics vulnerability while investigating the Mistubishi vulnerability. It makes me wonder what other vendor has used the same vulnerable version of IcoLaunch.dll in their product.

Mitsubishi also notes that the patch removes some functionality from the McWorX application. The report that they will work with individual customers to restore that functionality if necessary.

Siemens Advisory

Those of you who follow @SCADAHacker @DigitalBond, or me on Twitter® will already have heard a discussion about this vulnerability as the Siemens ProductCERT published their alert on early Tuesday morning (US time). This advisory reports an uncontrolled resource consumption vulnerability in Rugged Com ROS devices. The vulnerability was discovered by Ling Toh Koh, Ng Yi Teng, Seyed Dawood Sajjadi Torshizi, Ryan Lee, and Ho Ping Hou of EV-Dynamic, Malaysia.

ICS-CERT reports that skilled attacker could remotely exploit this vulnerability to execute a DoS attack that would disable switching functionality until a cold reboot was executed. Siemens has developed a patch for one of the affected versions and continues to work on the others. ICS-CERT will update this advisory as Siemens produces the other patches.

Siemens is to be congratulated on their early public disclosure of this vulnerability even as much as ICS-CERT is to be castigated for their delay in their conveying this advisory to the US public.

NTP Reflection Advisory

This advisory is more than a little unusual. The vulnerability, a vulnerability to DoS attacks staged using Network Time Protocol (NTP) Reflection, has apparently been in use for some period of time. And the vulnerability is not found in a single device or application, but rather any number of products using the NTP service.

ICS-CERT reports that a low skilled attacker ‘would be able’ to remotely exploit this vulnerability remotely using publicly available ‘exploits’ to execute DoS attacks on various control systems. They go on to report that an upgrade that mitigates this vulnerability has been available since 2010.

I don’t know which is scarier the fact that this vulnerability remains uncorrected in so many systems that ICS-CERT was finally forced to report this vulnerability, or the fact that it has taken almost four years for ICS-CERT to finally report this vulnerability.