Review – Public ICS Disclosures – Week of 6-11-22 – Part 1

This is another busy second-Tuesday disclosure week. For Part 1 we have 23 vendor disclosures from ABB, AUMA, Genetec, Hitachi Energy, HP (2), HPE (6), OPC UA (5), PROSYS OPC, QNAP, Tanzu, TI, and VMware (2).

ABB Advisory - ABB published an advisory that describes five privilege escalation vulnerabilities in their Automation Builder, Drive Composer and Mint WorkBench products.

AUMA Advisory - CERT-VDE published an advisory that discusses a classic buffer overflow vulnerability in the AUMA SIMA² Master Station.

Genetec Advisory - Genetec published an advisory that discusses the recently reported vulnerabilities in HID Mercury controllers.

Hitachi Energy Advisory - Hitachi Energy published an advisory that discusses an insecure method vulnerability in their PROMOD IV product.

HP Advisory #1 - HP published an advisory that discusses four information disclosure vulnerabilities in multiple HP products.

HP Advisory #2 - HP published an advisory that discusses an improper input validation vulnerability in multiple notebook products.

HPE Advisory #1 - HPE published an advisory that discusses four information disclosure vulnerabilities in their Synergy Servers.

HPE Advisory #2 - HPE published an advisory that discusses four information disclosure vulnerabilities in their Storage Products.

HPE Advisory #3 - HPE published an advisory that discusses four information disclosure vulnerabilities in their ProLiant DX Servers.

HPE Advisory #4 - HPE published an advisory that discusses four information disclosure vulnerabilities in their Moonshot/Edgeline Servers.

HPE Advisory #5 - HPE published an advisory that discusses four information disclosure vulnerabilities in their Superdome Flex Servers.

HPE Advisory #6 - HPE published an advisory that discusses four information disclosure vulnerabilities in their ProLiant BL/DL/ML/XL/MicroServer and Apollo Servers.

OPC UA Advisory #1 - OPC UA published an advisory that describes an uncontrolled resource consumption vulnerability in their .NET Standard Stack.

OPC UA Advisory #2 - OPC UA published an advisory that describes an incorrect implementation of authentication algorithm vulnerability in their .NET Standard Stack.

OPC UA Advisory #3 - OPC UA published an advisory that describes an uncontrolled resource consumption vulnerability in their .NET Standard Stack.

OPC UA Advisory #4 - OPC UA published an advisory that describes a memory allocation with excessive size value vulnerability in their .NET Standard Stack.

OPC UA Advisory #5 - OPC UA published an advisory that describes an infinite loop vulnerability in their .NET Standard Stack.

PROSYS OPC Advisory - PROSYS published an advisory that discusses a security feature bypass vulnerability (with publicly available exploit) in their OPC products.

QNAP Advisory - QNAP published an advisory that discusses a ransomware campaign that appears to target QNAP NAS devices running outdated versions of QTS 4.x.

Tanzu Advisory - Tanzu published an advisory that describes a denial of service vulnerability in their Spring Cloud product.

TI Advisory - TI published an advisory that describes missing ECC input validations on CC1310 and CC1350 devices.

VMware Advisory #1 - VMware published an advisory that describes an information disclosure vulnerability in their HCX product.

VMware Advisory #2 – VMware published an advisory that discusses four information disclosure vulnerabilities in their ESXi product.

For more details about these disclosures, including links to researcher reports, 3^rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-6-446 - subscription required.

Reader Comment – Another Log4Shell Advisory and Update

Early this morning (not so early in Israel) I had a reader DM me over on LinkedIn (FYI www.linkedin.com/in/patrickcoyle) about a couple of other vendor notifications about Log4Shell. One was one I had covered in an earlier post (but it was updated yesterday) and the other was new to me. So, I appreciate the information and will share it here. Oh, and this leads down an interesting rabbit hole.

Prosys OPC

Proxyx OPC published a blog post about the Log4Shell vulnerability. They do not have advisories, per se, they use their blogging function to also serve that purpose. In any case, while not as stylized as an advisory the post does provide listings of affected products, unaffected products, and available mitigation measures.

Siemens Update

Siemens published an update for their Log4Shell advisory that was originally published on December 12^th, 2021. The new information includes:

• Adding additional potentially affected products,

• Adding additional mitigation measures,

• Added CVE-2021-45046 (see discussion below), and

• Updated mitigation measures for new CVE.

Log4Shell2

Okay, the cute name is mine, but it looks like it may be appropriate. According to the NVD.NIST.gov entry for CVE-2021-45046: “It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.” Please see my TWEET® reply from yesterday morning.

According to the Apache Log4j Security Vulnerabilities page, this new vulnerability was reported to them by Kai Mindermann of iC Consult. That page also notes that:

“Other insufficient mitigation measures are: setting system property log4j2.formatMsgNoLookups or environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true for releases >= 2.10, or modifying the logging configuration to disable message lookups with %m{nolookups}, %msg{nolookups} or %message{nolookups} for releases >= 2.7 and <= 2.14.1.

“The reason these measures are insufficient is that, in addition to the Thread Context attack vector mentioned above, there are still code paths in Log4j where message lookups could occur: known examples are applications that use Logger.printf("%s", userInput), or applications that use a custom message factory, where the resulting messages do not implement StringBuilderFormattable. There may be other attack vectors. [emphasis added]

“The safest thing to do is to upgrade Log4j to a safe version, or remove the JndiLookup class from the log4j-core jar.”

Maybe we want to change the name to “Log4Hell”.