Public ICS Disclosures – Week of 08-17-19

This week we have two vendor disclosures for products from Bosch and Schneider and an update from Schneider.

Bosch Advisory

Bosch published an advisory describing three vulnerabilities in their ProSyst mBS SDK and Bosch IoT Gateway Software. The vulnerabilities are being self-reported. Bosch has new versions that mitigate the vulnerabilities.

The three reported vulnerabilities are:

• Path traversal - CVE-2019-11601;

• Server-side request forgery - CVE-2019-11897; and

• Information exposure through an error message - CVE-2019-11602

Schneider Advisory

Schneider published an advisory for the latest Microsoft® Remote Desktop Services (DejaBlue) vulnerabilities in their products running on machines using various MS operating systems. Generic mitigations are provided. Schneider does provide the following warning about applying the MS patches that should mitigate these vulnerabilities:

“Please note that as of the date of this publication, it is unclear how Microsoft’s patches and updates will affect systems performance. Therefore, customers should proceed with caution when applying these patches to critical operating systems and/or performance-constrained systems. We strongly recommend evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure.”

NOTE: This advisory has already been updated twice.

Schneider Update

Schneider published an update for their advisory on the Wind River VxWorks vulnerabilities in their products. They changed the affected products list by:

• Removin Modicon M580 Ethernet / Serial RTU Module; and

• Adding Modicon eX80 - BMEAHI0812 HART Analog Input Module

ICS-CERT Publishes Two Alerts and an Advisory

Yesterday ICS-CERT published alerts for systems from Clorius Controls and Mitsubishi and an advisory for a Wind River product.

Wind River Advisory

This advisory is for multiple vulnerabilities in the Wind River VxWorks Remote Terminal Operating System (RTOS) reported by Hisashi Kojima and Masahiro Nakada of Fujitsu Laboratories in  a coordinated disclosure. VxWorks is an operating system that is used in a variety of industrial control systems. The vulnerabilities include:

• Improper input validation, CVE-2013-0711, CVE-2013-0712, CVE-2013-0713, CVE-2013-0714, CVE-2013-0716; and

• Command injection, CVE-2013-0715.

ICS-CERT notes that a relatively low skilled attacker could remotely exploit these vulnerabilities though a couple require a user ID and password to exploit. Successful exploitation could lead to a DoS attack in most cases but exploitation of one of the improper validation vulnerabilities could lead to arbitrary code execution.

The advisory notes that “[a]ccording to Wind River, software patches” (pg 5) are available from Wind River technical support for all VxWork versions. This wording probably indicates that neither ICS-CERT nor the original researchers have validated the efficacy of the patches.

It would be helpful in situations like this where a vulnerability may affect products from multiple vendors if the advisory would note that either the reported mitigation would work on multiple vendor products or which vendor’s products were or were not protected by the mitigation measure. ICS-CERT would be the only organization that could possibly address this multiple vendor issue. As it is we must just assume that every product that uses VxWorks has these vulnerabilities and must be separately addressed by the using vendor.

Mitsubishi Alert

This alert addresses a heap-based buffer overflow vulnerability in an ActiveX control in the Mitsubishi MX SCADA/HMI product. The vulnerability disclosure (with exploit code) was reported by Dr IDE (not identified on the ICS-CERT alert) on the OSVDB.org web site on 3-26-13. The remotely exploitable vulnerability could result in arbitrary code execution.

Clorius Controls Alert

This alert addresses an information disclosure vulnerability in the Clorius Controls ICS SCADA product. This remotely exploitable vulnerability with publicly available exploit code could result in ‘loss of confidentiality’. The alert notes that ICS-CERT is still trying to contact the researcher and Clorius Controls about this vulnerability.

Researcher Identification

Standard verbiage in both alerts clearly state that ICS-CERT will provide attribution of the researcher who discovered the vulnerability unless “unless the reporter notifies ICS-CERT that they wish to remain anonymous”. That does not appear to be the case in either of these alerts; Dr IDE is clearly identified in the OSVDG report so he has no anonymity beyond his handle and ICS-CERT apparently hasn’t been able to contact the Clorius Controls researcher. Thus it appears that ICS-CERT is slipping back into its adversarial mode in dealing with authors of uncoordinated disclosures.

The bad news here is that the black hat community may have access to details about the Clorius Controls vulnerability that the vendor and owners may not be aware of. At least in the Mitsubishi alert ICS-CERT provided a link to the OSVDB web site discussing the vulnerability so that we all have a general picture of the vulnerability and a level playing field (though it was seven days late).