ICS-CERT: Siemens WinCC Multiple Vulnerabilities

Friday, June 08, 2012

Infosec Island Admin

7fef78c47060974e0b8392e305f0daf0

Independent researchers Gleb Gritsai, Alexander Zaitsev, Sergey Scherbel, Yuri Goltsev, Dmitry Serebryannikov, Sergey Bobrov, Denis Baranov, Andrey Medov from Positive Technologies have identified multiple vulnerabilities in the Siemens WinCC application.

In evaluating these reported vulnerabilities, Siemens identified an additional vulnerability that is included in this advisory. Siemens has produced an update that resolves all vulnerabilities except the buffer overflow in DiagAgent.

DiagAgent is no longer supported, and this vulnerability can be mitigated by disabling the service. ICS-CERT has not tested this update. These vulnerabilities may be remotely exploited.

AFFECTED PRODUCTS

Siemens WinCC 7.0 SP3 web server and web applications are affected.

IMPACT

These vulnerabilities may allow an attacker to gain unauthorized access, read from, or write to files and settings on the target system.

Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

BACKGROUND

Siemens SIMATIC HMI is a software package used as an interface between the operator and the programmable logic controllers (PLCs) controlling the process. SIMATIC HMI performs the following tasks: process visualization, operator control of the process, alarm display, process value and alarm archiving, and machine parameter management. This software is used in many industries, including food and beverage, water and wastewater, oil and gas, and chemical.

VULNERABILITY OVERVIEW

CROSS-SITE SCRIPTING:  WinCC web applications are susceptible to reflected cross-site scripting because they do not filter out characters when parsing URL parameters. Exploitation of this vulnerability may give an attacker authenticated access to WinCC web applications. CVE-2012-2595 has been assigned to this vulnerability. A CVSS v2 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:M/Au:N/C:N/I:P/A:N).

XML (XPATH) INJECTION:  Web applications do not filter out special characters when parsing URL parameters. An attacker may exploit this vulnerability to read or write settings on the system. CVE-2012-2596 has been assigned to this vulnerability. A CVSS v2 base score of 5.5 has been assigned; the CVSS vector string is (AV:N/AC:L/Au:S/C:P/I:P/A:N).

DIRECTORY TRAVERSAL:  Web applications do not sanitize URL parameters. An authenticated attacker can read arbitrary files on the system. CVE-2012-2597 has been assigned to this vulnerability. A CVSS V2 base score of 6.8 has also been assigned; the CVSS vector string is (AV:N/AC:L/Au:S/C:C/I:N/A:N).

BUFFER OVERFLOW:  The DiagAgent Web server is used for remote diagnostic purposes and is disabled by default. If the service is enabled, it does not sanitize user input correctly. Specially crafted input can crash the DiagAgent, disabling the remote diagnostic service. CVE-2012-2598 has been assigned to this vulnerability. A CVSS V2 base score of 4.3 has also been assigned; the CVSS vector string is (AV:N/AC:M/Au:N/C:N/I:N).

CROSS SITE SCRIPTING:  Web application accepts a parameter in a HTTP GET request and interprets it as a URL. The victim’s browser is then redirected to that URL. If a victim clicks on a link that was prepared by an attacker, the victim’s browser could be redirected to a malicious Web site instead of the WinCC system. CVE-2012-3003 has been assigned to this vulnerability. A CVSS V2 base score of 3.4 has also been assigned; the CVSS vector string is (AV:N/AC:M/Au:N/C:N/I:P/A:N/E:POC/RL:O/RC:C).

EXPLOITABILITY:  These vulnerabilities can be remotely exploited.

EXISTENCE OF EXPLOIT:  No known public exploits specifically target these vulnerabilities.

DIFFICULTY:  An attacker with a low skill would be able to exploit these vulnerabilities.

MITIGATION

Siemens has released a security advisory that can be found here:

Siemens has produced an update that resolves all vulnerabilities except the buffer overflow in DiagAgent. The buffer overflow was not fixed, because the vulnerable DiagAgent is turned off by default and is no longer distributed or supported. The update is available in Update 2 for WinCC V7.0 SP3. Siemens recommends applying this patch as soon as possible.

Siemens recommends not using DiagAgent, because it is no longer supported. Users can migrate to the SIMATIC Diagnostics Tool or the SIMATIC Analyser.

The Buffer Overflow vulnerability can only be exploited if the user starts the DiagAgent Web server manually. Siemens recommends that users check to ensure that the DiagAgent Web server is disabled and cautions users to only enable this option if and when it is needed.

The full ICS-CERT advisory can be found here:

Source:  http://www.us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf

Possibly Related Articles:
13321
SCADA
Industrial Control Systems
SCADA Vulnerabilities Cross Site Scripting Siemens Buffer Overflow ICS-CERT Industrial Control Systems Directory Traversal Simatic WINCC
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.