ICS-CERT Publishes Two Advisories

Today the DHS ICS-CERT published two control system security advisories for products from Rockwell and Westermo. The Rockwell advisory was originally published on the NCCIC Portal on July 27, 2017.

Rockwell Advisory

This advisory describes an SNMP remote code execution vulnerability in the Rockwell Allen-Bradley Stratix and ArmoStratix. The vulnerability was originally reported by Cisco and subsequently self-reported by Rockwell as affecting their switches. Rockwell has produced a newer version of one of the affected product families that mitigates the vulnerability. Rockwell has produced compensating controls for the remainder of the affected products pending further updates.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to execute code on an affected system or cause an affected system to crash and reload.

As always when these types of vulnerabilities from third party systems are reported, we have to ask what other vendors have also been using the same system and thus have the same vulnerabilities?

Westermo Advisory

This advisory describes three vulnerabilities in the Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 routers. The vulnerabilities were originally reported by Mandar Jadhav from Qualys Security. Westermo has produced a new firmware to mitigate the vulnerabilities. There are no indications that Jadhav was provided an opportunity to verify the efficacy of the fix.

The three reported vulnerabilities are:

• Cross-site request forgery - CVE-2017-12703;

• Hard-coded credentials - CVE-2017-12709; and

• Use of hard-coded cryptographic key - CVE-2017-5816

Westermo reports in their security advisory [.PDF Download] that a fourth vulnerability was reported by the researcher, but the default user account identified is not interactive and is not accepted in the existing management interfaces and is therefore not an immediate attack vector. It has, however, been removed from the updated firmware.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerabilities to obtain hard-coded cryptographic keys, hard-coded credentials, or trick a user into submitting a malicious request, resulting in the attacker gaining unauthorized access to the device and running arbitrary code.

ICS-CERT Publishes GarrettCom Advisory

This afternoon the DHS ICS-CERT published an advisory for GarrettCom Ethernet switches. The advisory describes multiple vulnerabilities in GarrettCom’s Magnum 6k and Magnum 10k product lines. The vulnerabilities were reported by Ashish Kamble of Qualys Security and Eireann Leverett. GarrettCom has produced new firmware versions to correct these vulnerabilities and ICS-CERT reports that Kamble has validated the efficacy of the fixes.

The reported vulnerabilities are:

∙ Use of hard-coded credentials, CVE-2015-3960 and CVE-2015-3959; and

∙ External control of assumed-immutable web parameter, CVE-2015-3961

It looks like there is a typo in the advisory where ICS-CERT usually reports the difficulty of exploiting the vulnerabilities; they repeat the previous comment about no known public exploits. Based upon past reports, however, I would suspect that a relatively low skilled attacker could remotely exploit the vulnerability.

Interestingly the Belden GarrettCom release note calls one of the hard-coded credential vulnerabilities an ‘SSL key exposure’ vulnerability. They explain that it is “possible for certain security keys of the Belden Garrettcom 10K and 6K products to be deciphered potentially posing a man-in-the-middle security threat when using HTTPS to communicate with the device”. The also maintain that the remaining hard-coded credential vulnerability only applies to a privileged account that “is actually not enabled in the operating switch”.

ICS-CERT notes that these two new firmware releases were made available in December of last year and January of this year. It is possible that some of these devices have already been fixed. The earlier release contained a number of other, non-security bug fixes. It is interesting that it has taken so long for this advisory to be published by ICS-CERT. I would assume that it was due to communications issues.