ICS-CERT Publishes Two Advisories and an Update

Today the DHS ICS-CERT published a control system security advisory for products from Siemens and a medical device security advisory for products from Naus Xltek. They also updated a control system security advisory for products from Siemens.

NOTE: There are still three Siemens advisories and two Siemens updates that were announced by Siemens on Tuesday that have not been covered by ICS-CERT. I will address those in my Saturday post.

Siemens Advisory

This advisory describes a permissions, privileges and access controls vulnerability in the Siemens SCALANCE X switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C. The vulnerability was reported by Dr. Ang Cui and Joseph Pantoga from Red Balloon Security. Siemens has provided updates for some of the affected products. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an uncharacterized attacker on the same local network segment could exploit the vulnerability to execute arbitrary code.

Natus Xltek Advisory

This advisory describes 8 vulnerabilities in the Natus Xltek NeuroWorks software. The vulnerabilities were reported by Cory Duplantis from Cisco Talos. Natus Xltek has produced an update to mitigate the vulnerabilities. There is no indication that Duplantix has been provided an opportunity to verify the efficacy of the fix.

The eight reported vulnerabilities are:

• Out-of-bounds read (4) - CVE-2017-2852, CVE-2017-2858, CVE-2017-2860, and CVE-2017-2861; and

• Stack-based buffer overflow (4) - CVE-2017-2853, CVE-2017-2867, CVE-2017-2868, and CVE-2017-2869.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit these vulnerabilities to crash the device being accessed; a buffer overflow condition may allow remote code execution.

Siemens Update

This update provides additional information on an advisory that was originally issued on November 8, 2016 and then updated November 22^nd, 2016; December 23^rd, 2016; February 14^th, 2017; March 2^nd, 2017,  May 9^th, 2017, June 20^th, 2017, and again on January 25^th, 2018. The update provided corrected affected version numbers and a link to a mitigation measure for PCS 7 V8.2.

Public ICS Disclosure – Week of 5-26-18

This week we have a vendor update of a previously released advisory, a coordinated disclosure of multiple vulnerabilities in a medical device, and an exploit for a previously disclosed vulnerability. In passing, there was a new advisory from Schneider (U.Motion Builder) that was released on Thursday that may yet be reported by ICS-CERT.

Spectre Update

This week Siemens updated their advisory on the Spectre vulnerabilities in Industrial Products to add mitigation measures for:

• RUGGEDCOM APE;

• RUGGEDCOM VPE1400;

• SINEMA Remote Connect;

• SIMATIC S7-1518-4 PN/DP ODK;

• SIMATIC S7-1518F-4 PN/DP ODK; and

• SIMATIC HMI Panels

ICS-CERT does not update their multi-vendor advisories to reflect vendor updates as the links provided generally point to the new information. From an ICS-CERT administrative point of view, this makes a certain amount of sense.

Siemens also updated their general Spectre advisory to reflect information on the next generation Spectre. It will be sometime yet before the Spectre NG will be reflected in the product specific advisories as we are still waiting on the chip-level mitigations to be produced.

Medical Device Disclosure

This week Talos published three reports (here, here and here) of vulnerabilities in the  Natus Xltek NeuroWorks software; these are coordinated disclosures. The three reported vulnerabilities are:

• Invalid key entry denial of service - CVE-2017-2860;

• Deserialization denial of service - CVE-2017-2852; and

• Traversal denial of service - CVE-2017-2858

NOTE: These have not been reported on the FDA Medical Device Safety Communications page.

Siemens Exploit

This week we have another exploit report from t4rkd3vilz on Exploit-DB.com. This one is for a Siemens SIMATIC S7-300 that was originally reported in 2015. While ICS-CERT will note if a publicly available exploit exists at the time of publication of their advisories, they do not generally provide updates that report new exploits.