Siemens has reported a privilege escalation vulnerability in the Siemens COMOS database application. Siemens has produced an update that fixes this vulnerability. This vulnerability could be exploited remotely.
Siemens reports that the vulnerability affects the following versions of COMOS:
• All versions earlier than Version 9.1
• Version 9.1: Patch 412 and earlier
• Version 9.2: Update 3 Patch 022 and earlier
• Version 10: Patch 004 and earlier
IMPACT
Authenticated users with read privileges could escalate their privileges by exploiting this vulnerability. Thus, the attacker is able to gain administrator access to the database.
Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.
BACKGROUND
Siemens COMOS is an object oriented database system that supports collecting, processing, saving, and distributing of information through a design process. It allows the configuration of different user privileges to different users.
VULNERABILITY OVERVIEW
PRIVILEGE ESCALATION: Authenticated users with read privileges could escalate their privileges by exploiting a documented method in the design of the database. As a result, the attacker gains administrator access to the database. CVE-2012-3009 has been assigned to this vulnerability. A CVSS v2 base score of 8.5 has been assigned; the CVSS vector string is (AV:N/AC:M/Au:S/C:C/I:C/A:C).
EXPLOITABILITY: This vulnerability could be exploited remotely.
EXISTENCE OF EXPLOIT: No known public exploits specifically target this vulnerability.
DIFFICULTY: An attacker with a medium skill level could exploit these vulnerabilities.
MITIGATION
For COMOS Versions 9.1, 9.2, and 10.0, Siemens recommends installing the corresponding patches as soon as possible:
• Version 9.1 Patch 413
• Version 9.2 Update 03 Patch 023
• Version V10 Patch 005.
These software updates are available at Siemens customer support. earlier versions, Siemens recommends upgrading to a newer version.
The full ICS-CERT advisory can be found here:
Source: http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf