Public ICS Disclosure – Week of 11-24-18

This week we have three vendor disclosures from Schneider Electric, ABB and Siemens, exploit code for a previously disclosed vulnerability and a disclosure from a researcher which is probably been coordinated with Moxa. And there is a special non-disclosure disclosure at the end of the post.

Schneider Advisory

This advisory describes five vulnerabilities in the Schneider Embedded Web Servers for Modicon V1.1 PLC’s. The vulnerabilities were reported by Tenable. Schneider has provided generic fixes to mitigate the vulnerability. There is no indication that Tenable has been provided an opportunity to verify the efficacy of the fix.

The five reported vulnerabilities are:

• Unverified password change (2) - CVE-2018-7811 and CVE-2018-7809;

• Cross-site scripting - CVE-2018-7810;

• Basic XSS - CVE-2018-7831; and

• HTTP response splitting - CVE-2018-7830

ABB Advisory

This advisory describes an improper input validation vulnerability in the ABB CP400 Panel Builder TextEditor 2.0. The vulnerability was reported by Ivan Sanchez from Nullcode Team. ABB has an updated version of the affected products to mitigate the vulnerability. ABB reports that Sanchez has verified the efficacy of the fix.

Siemens Advisory

This advisory describes 21 vulnerabilities in GNU/Linux subsystem of

the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP. The vulnerabilities were reported by an unidentified ‘external source’. Siemens reports that the vulnerabilities will be corrected in the next firmware version and currently provides generic mitigation advice.

The advisory provides links to 21 CVE’s without a description of the associated vulnerability or risk evaluation of the vulnerability in the affected system. I have clicked through on a couple of these links to the Debian.org reports on the vulnerabilities and there are a wide variety of vulnerabilities involved here with reports of public exploits for many of them. Those exploits are not specifically for the Siemens implementation of these processes, but a reasonably competent hacker could probably use them to craft a Siemens specific exploit.

NOTE: Insert standard blurb about 3^rd party vulnerabilities potentially being found in products from other vendors. Fortunately (sarcasm warning) Linux is a rather obscure OS and is seldom seen in real operations. (SIGH)

Schneider Exploit

PHOTUBIAS published an exploit for a session calculation authentication bypass vulnerability in the Schneider Modicon PLCs. This vulnerability was previously reported by ICS-CERT.

NOTE: Exploit-DB.com has ‘updated’ the layout of their site. Larger print in headers, more colorful, but unfortunately harder to read. Too bad.

Moxa Vulnerabilities

Maxim Khazov reports two OS command injection vulnerabilities in the Moxa NPort W2x50A wireless device servers. The report includes proof of concept exploit instructions. Khazov reports that Moxa has fixed these vulnerabilities in a newer version, but it is not clear if this is a coordinated disclosure.

Bonus Non-Disclosure Disclosure

This week OSIsoft released a new version of PI Integrator for Business Analytics. In the release notes (pg 12) OSIsoft notes that:

“For this release of the PI Integrator for Business Analytics, one security vulnerability was identified and fixed. The resolved issue was rated using the Common Vulnerability Scoring System (CVSS).”

The only other information provided was that the CVSS score was rated as low (0.1 to 3.9).

Now I have a lot of respect for OSIsoft’s commitment to security and I am a big fan of their PI Processbook application, but the way OSIsoft has handled this non-disclosure is disappointing. It is great that they have fixed this unidentified, low-risk security vulnerability, but they have provided no security incentive to owners of this product to upgrade to this new version. The other fixes enumerated in the release notes may provide adequate incentive to upgrade, but if folks have not had problems with those listed issues, a defined security problem might make a difference.

BTW: I really hate it when people set security on .PDF documents so that they will not allow cutting and pasting from the documents. Really? I like to make sure that when I quote a document, I do it accurately. Cutting and pasting is the easiest, most efficient way of doing that. Re-typing just sets me up for making errors. And, the quote is still there.

ICS-CERT Publishes 3 Advisories

This morning the DHS ICS-CERT published three advisories for control system components from Rockwell, Eaton Lighting Systems and Pro-Face. Two of the three advisories had previously been released on the US CERT Secure Portal.

Rockwell Advisory

This advisory describes an access violation memory error in the Rockwell Automation Integrated Architecture Builder (IAB) application. The vulnerability was reported by Ivan Sanchez from Nullcode Team. Rockwell has produced a software update to mitigate the vulnerability, but there is no indication that Sanchez has been afforded the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a social engineering attack is required to get an authorized user to load to introduce or change project files and then access the malformed file. ICS-CERT does not count such social engineering attacks as being remotely executable.

The advisory includes a number of additional mitigation measures that Rockwell recommends that owners implement when using the IAB application.

Eaton Lighting Systems Advisory

This advisory describes twin vulnerabilities in the Eaton Lighting Systems EG2 Web Control application. The vulnerabilities were reported by Maxim Rupp. Eaton has produced a firmware patch to mitigate the vulnerability, but there is no indication that Rupp has been provided an opportunity to verify the efficacy of the fix.

The two vulnerabilities were:

• Reliance on cookies without validation and integrity checking - CVE-2016-2272; and

• Cleartext storage of sensitive information - CVE-2016-0871

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to configure the system.

ICS-CERT reports that though a firmware patch has been made available, that Eaton will be moving this product to end of life later this year and recommends that owners upgrade to the new system. It is nice to see that the patch was developed anyway.

Pro-face Advisory

This advisory describes four vulnerabilities in the Pro-face GP-Pro EX HMI software. The vulnerabilities were reported by ZDI (the first three) and Jeremy Brown. Pro-face has produced an update module to mitigate the vulnerabilities, but there is no indication that the researchers were afforded to the opportunity to verify the efficacy of the fix.

The vulnerabilities include:

• Heap-based buffer overflow - CVE-2015-2290;

• Out-of-bounds read - CVE-2015-2291;

• Stack-based buffer overflow - CVE-2015-2292; and

• Use of hard-coded credentials - CVE-2015-7921

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to execute arbitrary code.

It is odd that a Schneider Electric company would not publish a security advisory for four vulnerabilities, two of which are fairly serious.

ICS-CERT Updates Advisory and Publishes New Advisory

This morning the DHS ICS-CERT published an update for an advisory published in December for a cross-site scripting vulnerability in the in XZERES 442SR turbine generator operating system (OS). It also published a new advisory for a vulnerability in the ABB Panel Builder 800.

XZERES Update

This update corrects the CVE number for the vulnerability. The CVE number published in the original advisory was actually for another cross-site scripting vulnerability in the same equipment that was reported by ICS-CERT in an advisory published in March of last year.

ABB Advisory

This advisory describes a DLL hijacking vulnerability in the ABB Panel Builder 800. The vulnerability was reported by Ivan Sanchez from Nullcode Team. ABB has produced a new version of the software that mitigates the vulnerability. There is no indication that Sanchez has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that an attacker must get malicious code to a specific directory in the file system and then convince an authorized operator to execute the code. ICS-CERT says that this cannot be exploited remotely.

The ABB Security Advisory (not referenced in this advisory) for this vulnerability has a workaround that can be used pending the updating of the software to the newer version. Thanks to Joel Langill for tweeting about this document this morning.

ICS-CERT Updates XZERES Advisory and Publishes 2 New Advisories

This afternoon the DHS ICS-CERT updated the XZERES advisory published earlier this week. It also published controls system advisories for products from Open Automation and Advantech.

XZERES Update

This update revises the description of the potential impact of the vulnerability. Originally it said that: “Successful exploitation of this vulnerability allows the ID to be retrieved from the browser and will allow the default ID to be changed.” Now it reads: “Successful exploitation of this vulnerability could allow the injection of malicious script.” That is a significant change in impact.

The description of the cross-site scripting vulnerability has also been changed. Originally it said: “The 442SR OS recognizes both the POST and GET methods for data input. By using the GET method, an attacker may retrieve the ID from the browser and will allow the default user ID to be changed. The default user has admin rights to the entire system.” It now reads: “The 442SR OS does not provide adequate input validation. This could allow malicious script to be injected into the program.” The CVSS v3 base score remains 9.8.

NOTE: This update is listed on the ICS-CERT landing page, but just because the original would still be there and the change was made to the original listing. I still recommend following @ICSCERT on TWITTER to get notified of these updates.

Open Automation Advisory

This advisory describes an uncontrolled search path element vulnerability in the Open Automation Software OPC Systems.NET application. The vulnerability was reported by Ivan Sanchez from Nullcode Team. ICS-CERT reports that Open Automation Software does not intend to patch the vulnerability at this time.

ICS-CERT reports that a social engineering attack is required to exploit this DLL hijacking vulnerability. A successful exploit would give the attacker access at the same privilege level as the application.

ICS-CERT reports that: “Open Automation Software has passed the researcher information to its support team to assist customers in the event that they encounter this vulnerability.”

Advantech Advisory

This advisory describes three vulnerabilities in the Advantech EKI-132x platform devices. This was an uncoordinated disclosure made by Tod Beardsley of Rapid7. Advantech plans to release updated firmware to fix these vulnerabilities by the end of this month.

The three vulnerabilities are:

• OS command injection (Shellshock) - CVE-2014-6271;

• Improper restriction of operations within the bounds of a memory buffer (Heartbleed) - CVE-2014-0160; and

• Improper restriction of operations within the bounds of a memory buffer - CVE-2012-2152

ICS-CERT reports that a relatively unskilled attacker could remotely exploit these vulnerabilities using publicly available exploit code to execute arbitrary code, to obtain private keys, or to impersonate the authenticated user and perform a man-in-the-middle attack.

NOTE: This is the ‘missing’ advisory that I reported on last week. Interestingly there is no mention in the advisory of the apparent fact that these vulnerabilities worked their way back into the system as part of the update to fix an earlier vulnerability.

ICS-CERT Publishes Two Advisories

This afternoon the DHS ICS-CERT published two new advisories for control system vulnerabilities in systems from Siemens and PACTware.

PACTware Advisory

This advisory describes a handling of exceptional conditions vulnerability in PACTware Consortium’s PACTware application. The vulnerability was reported by Ivan Sanchez from Nullcode Team. PACTware has produced a service pack for the application and ICS-CERT reports that Sanchez has verified the efficacy of the fix.

ICS-CERT reports that a social engineering attack would have to be used to convince an operator to load and run a specially crafted file.

ICS-CERT reports that the new version (Service Pack 3) can be downloaded from the PACTware Consortium site. There are actually seven different companies using that web site to distribute PACTware 4.1. But only one of the seven companies, KROHNE Messtechnik GmbH,  listed on the site clearly has 4.1 SP3 available for download. I could not find the PACTware download on two of the sites and the other four did not list either version numbers or SP numbers.

Siemens Advisory

This advisory describes a cross site scripting vulnerability in the Siemens Climatix BACnet/IP communication module. The vulnerability was reported by Juan Francisco Bolivar Hernandez. Siemens has produced a firmware update to mitigate the vulnerability. There is no indication that Hernandez was given an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability.

The Siemens advisory on this vulnerability notes that the new firmware version has an additional security improvement; web server authentication is enabled by default.

ICS-CERT Publishes Update and Two Advisories

Yesterday the DHS ICS-CERT published an update for a year-old OleumTech advisory and two new advisories for systems from Emmerson and Schneider.

OleumTech Update

This update effectively closes out the mitigation side of a very peculiar advisory issued last year. In that original advisory ICS-CERT published their document without any apparent agreement from OleumTech that vulnerabilities actually existed. This update takes out two very interesting sentences from the original now that OleumTech has published updates that resolve the vulnerabilities. Those sentences stated:

“The researchers have coordinated the vulnerability details with NCCIC/ICS-CERT and OleumTech in hopes the vendor woulddevelop security patches to resolve these vulnerabilities. While ICS-CERT has had many discussions with both OleumTech and IOActive this past year, there has not been consensus on vulnerability details and positive product developments to resolve identified vulnerabilities.”

In discussing the now available updates for the systems ICS-CERT also removes the following description of the original OleumTech response:

“The vendor and IOActive researcher team do not completely agree with ICS-CERT about the severity and validity of these vulnerabilities. The vendor has stated they do not plan to resolve vulnerabilities they consider not valid.”

I suspect that OleumTech made some changes in their system unrelated to the reported vulnerabilities and realized that they could be considered to be mitigation measures and reported that to ICS-CERT. There is no indication that the original researchers have been given the chance to verify the efficacy of the fixes. In any case it looks like it took two years to fix the vulnerabilities.

Emmerson Advisory

This advisory describes an SQL injection vulnerability in the Emerson AMS Device Manager Application. This vulnerability was apparently self-reported and Emerson has developed a patch for newer versions of the system and a configuration fix for older versions.

ICS-CERT reports that a moderately skilled attacker could exploit this vulnerability to gain privilege escalation on the device manager, but not to the underlying computer system.

This advisory was originally released on the US CERT Secure Portal on April 21^st. It seems odd to me that a vulnerability that requires local access to exploit would get released on the Secure Portal for a month before public release when many more serious and remotely exploitable vulnerabilities get public release immediately.

Schneider Advisory

This advisory describes a DLL hijacking vulnerability in the Schneider OPC Factory Server (OFS) application. The vulnerability was originally reported by Ivan Sanchez from Nullcode Team. Schneider has produced a patch that mitigates the vulnerability and Sanchez has been given the opportunity to verify the efficacy of the fix.

ICS-CERT reports that a social engineering attack is required to exploit this vulnerability. A successful exploit could cause a server crash or allow execution of arbitrary code. The Schneider advisory (.PDF Download) does not mention the possibility of code execution.

ICS-CERT Publishes OPTO 22 Advisory

This afternoon the DHS ICS-CERT published an advisory for twin buffer overflow vulnerabilities in OPTO 22 products. The vulnerabilities were reported by Ivan Sanchez from Nullcode Team. OPTO has released new versions that mitigate the vulnerabilities and Sanchez has been able to verify the efficacy of the fix.

The twin vulnerabilities are:

∙ Heap-based buffer overflow, CVE-2015-1006; and

∙ Stack-based buffer overflow, CVE-2015-1007.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit the heap-based overflow vulnerability. The Stack-based overflow would require a social engineering attack before the vulnerability could be remotely exploited.

OPTO reports that the stack-based overflow vulnerability actually resides in a Rockwell OPC Test Client application (no version number is provided). The newer, unaffected OPTO 22 products use a ProSys Test Client application instead. Owners can obtain a copy of the ProSys Test Client from the OPTO 22 FTP site if they do not want to install the updated version of the PAC Project applications.

This is apparently just another case of a vendor using another vendor’s files without understanding the included vulnerabilities. It would be interesting if someone (ICS-CERT MAYBE) would look to see how many other systems were using the vulnerable Rockwell OPC Test Client.