Bills Introduced – 12-6-24

Yesterday, with just the House in session, there were 14 bills introduced. One of those bills will receive additional attention in this blog (if anything happens before the end of the session, very unlikely):

HR 10320 To amend title 51, United States Code, to establish a Commercial Space Transportation Administration, and for other purposes. Kiley, Kevin [Rep.-R-CA-3]

Review – Public ICS Disclosures – Week of Week of 11-30-24

This week we have fourteen vendor disclosures from Broadcom, Cisco, Dell, Festo, Hitachi, HPE, Moxa, Philips, QNAP (3), Rockwell, WAGO, and Zyxel. There are seven vendor updates from Broadcom, FortiGuard (4), Moxa, and Palo Alto Networks. We also have five researcher reports for products from ABB (4) and WAGO. Finally, we have four exploits for FortiGuard, Intelligent Security Systems, Siemens, and VMware.

Advisories

Broadcom Advisory - Broadcom published an advisory that discusses nine vulnerabilities in their Brocade SANnav product.

Cisco Advisory - Cisco published an advisory that describes an improper access control vulnerability in their NX-OS product.

Dell Advisory - Dell published an advisory that discusses 18 vulnerabilities in their Dell ThinOS.

Festo Advisory - CERT-VDE published an advisory that discusses three vulnerabilities in the Festo provided CODESYS Gateway Server.

Hitachi Advisory - Hitachi published an advisory that describes a use of default credentials vulnerability in their Ops Center OVA product.

HPE Advisory - HPE published an advisory that describes four vulnerabilities in their Aruba Networking ClearPass Policy Manager.

Moxa Advisory - Moxa published an advisory that describes an improper validation of specified type of input vulnerability in their VPort 07-3 Series IP cameras.

Philips Advisory - Philips published an advisory that discusses an improper handling of file names that identify virtual resources vulnerability in the Sailpoint IdentityIQ Identity and Access Management software.

QNAP Advisory #1 - QNAP published an advisory that describes a link following vulnerability in their Qsync Central product. The vulnerability was reported by c411e.

QNAP Advisory #2 - QNAP published an advisory that describes eight vulnerabilities in their QTS and QuTS hero products.

QNAP Advisory #3 - QNAP published an advisory that describes an OS command injection vulnerability in their License Center product.

Rockwell Advisory - Rockwell published an advisory that describes four vulnerabilities in their Arena product. The vulnerabilities were reported by the Zero Day Initiative.

WAGO Advisory - CERT-VDE published an advisory that discusses an improper check for unusual or exceptional conditions vulnerability in the WAGO Basic Controller products.

Zyxel Advisory - Zyxel published an advisory that describes three vulnerabilities in multiple Zyxel communications products.

Updates

Broadcom Update - Broadcom published an update for their Azul Zulu advisory that was originally published on July 26^th, 2024, and most recently updated on July 29^th, 2024.

FortiGuard Update #1 - FortiGuard published an update for their HTTP/2 CONTINUATION Frames advisory that was originally published on May 14^th, 2024, and most recently updated on November 21^st, 2024.

FortiGuard Update #2 - FortiGuard published an update for their regreSSHion advisory that was originally published on July 9^th, 2024, and most recently updated on November 22^nd, 2024.

FortiGuard Update #3 - FortiGuard published an update for their FortiOS advisory that was originally published on April 9^th, 2024, and most recently updated on May 15^th, 2024.

FortiGuard Update #4 - FortiGuard published an update for their Stack buffer overflow on Bluetooth advisory that was originally published on June 11^th, 2024.

Moxa Update - Moxa published an update for their Weak SSL/TLS Key Exchange advisory that was originally published on November 4^th, 2024, and most recently updated on November 22^nd, 2024.

Palo Alto Networks Update - Palo Alto Networks published an update for their GlobalProtect App advisory that was originally published on November 25^th, 2024.

Researcher Reports

ABB Reports - Zero Science published four reports about individual vulnerabilities in the ABB Cylon Aspect.

WAGO Report - Nozomi Networks published a report that describes eight vulnerabilities in the WAGO PLC device model 750-8216/025-001.

Exploits

FortiGuard Exploit - sfewer-r7 published a Metasploit module for a missing authentication for critical function vulnerability (listed in CISA’s Known Exploited Vulnerability catalog) in the FortiGuard FortiManager products.

Intelligent Security Systems Exploit - Milad Karimi published an exploit for an unquoted service path vulnerability in the Intelligent Security Systems SecureOS.

Siemens Exploit - Stefan Viehböck, and Constantin Schieber-Knöbl of SEC Consult published an exploit for an improper NULL termination vulnerability in the Siemens JTAG Interface.

VMware Exploit - Matei Mal Badanoiu published a Metasploit module for a ASP.NET misconfiguration: use of identity impersonation vulnerability in the VMware vCenter Server.

 

For more information on these disclosures, including links to 3rd party advisories and researcher reports, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-week - subscription required. 

Short Takes – 12-6-24

What China’s critical mineral ban means for the US. TechnologyReview.com article. Pull quote: “In the end, it’s not clear either nation wins in a protracted and increasingly combative trade war. But it’s also not apparent that mutually assured economic damage will prove to be an effective deterrent. Indeed, China may well feel the need to impose stricter measures in the coming months or years, as there are few signs that President-elect Trump intends to tone down his hawkish stance toward China.”

483. WMD Threat: Now and in the Future. MadSciBlog.TRADOC.Army.mil post. Pull quote: “The UAF General Staff reported Russia most often used chemical grenades (e.g., K-51s and RGDs), dropped from Unmanned Aerial Vehicles (UAVs).  Russia also reportedly uses Improved Explosive Devices (IEDs) with irritants added and artillery shells loaded with hazardous chemicals.^[v]  Chemical agents employed by Russia include Chloropicrin, a strong irritant developed for use by Czarist Russia as poison gas during World War I, and tear gas (CS) variants:  2-Chlorobenzylidene Malononitrile and Cheryomukha.  Russia’s battlefield use of chemical agents includes degrading troop effectiveness in confined defensive positions (e.g., buildings, tunnels, and trenches), and flushing troops from these defenses to expose them to kinetic fires.”

Wednesday Reader: Presidential Pardons. Substack.com article. Pull quote: “Something important to note is that a pardon is not an expungement, nor does it erase a conviction off of a person’s record or signify innocence [1]. It does, however, restore certain rights lost when someone is convicted of a felony, as well as ease the amount of stigma surrounding the conviction. A person who receives a presidential pardon still needs to disclose their convictions when required, like when applying for things, but they can also mention that they were pardoned. As for whether or not accepting a presidential pardon is an official admission of guilt is still up for debate, though per the 1915 Supreme Court case Burdick V United States, a pardon “carries an imputation of guilt and an acceptance of a confession of it””

Securing the Information and Communications Technology and Services Supply Chain. Federal Register DOC (BIS) final rule. Summary: “On January 19, 2021, the Department of Commerce (Department) issued an interim final rule establishing procedures for its review of transactions involving information and communications technology and services (ICTS) designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary that may pose undue or unacceptable risk to the United States or U.S. persons. In the interim final rule, the Department solicited public comments and committed to promulgating a final rule. This final rule responds to public comments on the interim final rule and finalizes the practices guiding review of ICTS Transactions, amending and, in some cases, removing terms or concepts which experience has shown to be unnecessary, inefficient, or ineffective.”

USDA Announces New Federal Order, Begins National Milk Testing Strategy to Address H5N1 in Dairy Herds. USDA.gov press release. Pull quote: “The Federal Order [link added] released today makes three new requirements. First, it requires the sharing of raw milk samples, upon request, from any entity responsible for a dairy farm, bulk milk transporter, bulk milk transfer station, or dairy processing facility that sends or holds milk intended for pasteurization. Second, the Federal Order requires herd owners with positive cattle to provide epidemiological information that enables activities such as contact tracing and disease surveillance. Finally, like USDA’s April 24 Federal Order, it requires that private laboratories and state veterinarians report positive results to USDA that come from tests done on raw milk samples drawn as part of the NMTS. The first round of silo testing under the Federal Order and the NMTS is scheduled to begin the week of Dec. 16, 2024, although some states are already conducting testing compatible with the NMTS.” See APHIS HPAI Testing web page.

OMB Approves EPA Carbon Tetrachloride TSCA Final Rule

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule for the EPA on “Carbon Tetrachloride (CTC); Regulation under the Toxic Substances Control Act (TSCA)”. This final rule was sent to OIRA on June 24^th, 2024. The notice of proposed rulemaking was published on July 28^th, 2023.

According to the Spring 2024 Unified Agenda entry for this rulemaking:

“Environmental Protection Agency (EPA) proposed to address the unreasonable risk of injury to human health presented by carbon tetrachloride (CTC) under its conditions of use as documented in EPA’s 2020 Risk Evaluation for Carbon Tetrachloride and 2022 Revised Unreasonable Risk Determination for Carbon Tetrachloride pursuant to the Toxic Substances Control Act (TSCA). CTC is a volatile, organic compound that is primarily used as a feedstock (i.e., processed as a reactant) in the making of products such as refrigerants, aerosol propellants, and foam-blowing agents. TSCA requires that EPA address by rule any unreasonable risk of injury to health or the environment identified in a TSCA risk evaluation and apply requirements to the extent necessary so that the chemical no longer presents unreasonable risk. EPA determined that CTC presents an unreasonable risk of injury to health due to cancer from chronic inhalation and dermal exposures and liver toxicity from chronic inhalation, chronic dermal, and acute dermal exposures in the workplace. To address the identified unreasonable risk under TSCA, EPA proposed to establish workplace safety requirements for most conditions of use, including the condition of use related to the making of low Global Warming Potential (GWP) hydrofluoroolefins (HFOs), prohibit the manufacture (including import), processing, distribution in commerce, and industrial/commercial use of CTC for conditions of use where information indicates use of CTC has already been phased out, and establish recordkeeping and downstream notification requirements. The use of CTC in low GWP HFOs is particularly important in the Agency’s efforts to support the American Innovation and Manufacturing Act of 2020 (AIM Act) and the Kigali Amendment to the Montreal Protocol on Substances that Deplete the Ozone Layer, which was ratified on October 26, 2022. The Agency’s development of this rule incorporates significant stakeholder outreach and public participation. EPA engaged in discussions with industry, non-governmental organizations, other government agencies, technical experts and users of CTC, and the general public to hear from users, academics, manufacturers, and members of the public health community about practices related to commercial uses of CTC; public health impacts of CTC; the importance of CTC in the various uses subject to this proposed rule; frequently-used substitute chemicals or alternative methods or lack thereof; engineering controls, administrative controls, and personal protective equipment currently in use or feasibly adoptable; and other risk-reduction approaches that may have already been adopted or considered for industrial and commercial uses. EPA conducted Federalism, Tribal, and Environmental Justice consultations and a Small Businesses Advocacy Review Panel. EPA's risk evaluation for CTC, describing CTC’s conditions of use, is in docket EPA-HQ-OPPT-2019-0499 [link added], with the December 2022 unreasonable risk determination and additional information in docket EPA-HQ-OPPT-2016-0733 [link added].”

I will not be covering this final rule in any detail, but I will announce its publication in the appropriate ‘Short Takes’ post.

Transportation Chemical Incidents – Week of 11-2-24

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

Incidents Summary

• Number of incidents – 460 (428 highway, 24 air, 7 rail, 1 water)

• Serious incidents – 8 (8 Bulk release, 0 evacuation, 0 injury, 0 death, 0 major artery closed, 1 fire/explosion, 30 no release)

• Largest container involved – 43,272-gal DOT 112J340W Railcar {Liquefied Petroleum Gas} The sample line valve was cracked near the threads to the sample line nipple.

• Largest amount spilled – 1,300-gal DOT 112J340W Railcar {Liquefied Petroleum Gas} The sample line valve was cracked near the threads to the sample line nipple.

NOTE: Links above are to Form 5800.1 for the described incidents.

Most Interesting Chemical: Ammonium Hydrogendifluoride, Solid - A white crystalline solid. Soluble in water. Corrosive to tissue. Used to sterilize food processing equipment, in chemical analysis, for electroplating and for many other uses. (Source: CameoChemicals.NOAA.gov). 

OMB Approves EPA NOx and SOx Ecological Effects Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the EPA on “Review of the Secondary National Ambient Air Quality Standards for Ecological Effects of Oxides of Nitrogen, Oxides of Sulfur and Particulate Matter”. There is a consent decree requiring the EPA to sign the final rule by December 10^th, 2024. The notice of proposed rulemaking (NPRM) for this action was published on April 15^th, 2024.

According to the Spring 2024 Unified Agenda entry for this rulemaking:

“Under the Clean Air Act, the EPA is required to review and, if appropriate, revise the air quality criteria and national ambient air quality standards (NAAQS) every 5 years. On April 3, 2012, the EPA published a final rule in which the Agency determined to retain the current secondary standards (welfare-based) for nitrogen oxides (NOx) and for sulfur oxides (SOx). On January 15, 2013, the EPA published a final rule in which the Agency retained the secondary standards for particulate matter. The current review of the air quality criteria and secondary standards for ecological effects of SOx, N oxides and particulate matter included the preparation of an Integrated Science Assessment and a Policy Assessment by the EPA, with opportunities for review by the EPA's Clean Air Scientific Advisory Committee (CASAC) and the public. These documents informed the Administrator's proposed decision to strengthen the secondary NAAQS for sulfur oxides (SOx) to 10-15 ppb, as an annual average, averaged over 3 years; while proposing to retain existing secondary standards for nitrogen oxides (N oxides) and particulate matter (PM). The proposed decision was published in the Federal Register with opportunity provided for public comment. Opportunities for public engagement and sharing of information concerning this NAAQS review include public hearings, tribal consultation, informational meetings, and CASAC public meetings. The Administrator’s final decisions will take into consideration published documents, CASAC advice, and public comment on the proposed decision. EPA is under a consent decree for this review to sign the final rule [emphasis added] by December 10, 2024.”

This is another environmental rulemaking that I expect the Trump administration to ‘delay’ the implementation of on January 20^th, 2024. It is interesting to note that even an indefinite delay of implementation will not violate the consent decree, but I would expect to see the case being reopened by the plantiffs.

I will not be covering this final rule in any detail, but I will report its publication in the appropriate ‘Short Takes’ post.

EPA Sends CMAS NESHAP NPRM to OMB

Yesterday OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking (NPRM) from the EPA on “National Emission Standards for Hazardous Air Pollutants: Chemical Manufacturing Area Source Technology Review”.

According to the Spring 2024 Unified Agenda entry for this rulemaking:

“This action will address the agency's technology review of the National Emission Standards for Hazardous Air Pollutants (NESHAP) for Chemical Manufacturing Area Sources (CMAS). The CMAS NESHAP, subpart VVVVVV, was promulgated on October 29, 2009, pursuant to section 112(d) of the Clean Air Act (CAA) and established emission limitations and work practice requirements for controlling emissions of hazardous air pollutants (HAP). The NESHAP controls HAP emissions from process vents, storage tanks, equipment leaks, wastewater streams, transfer operations and heat exchange systems. This action addresses the technology review requirements of CAA section 112(d)(6) which require the EPA to review and revise the standards as necessary (taking into account developments in practices, processes and control technologies) no less often than every 8 years.”

This rulemaking first appeared in the Fall 2019 Unified Agenda. The Spring 2024 Unified Agenda entry is the first that includes a judicial deadline (consent decree) for the NPRM to be signed by the EPA by November 13^th, 2024 (oops they missed that one). The draft consent decree also includes a deadline for the signing of the final rule by EPA no later than September 17^th, 2025.