Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1938
Rockwell Automation Allen-Bradley Stratix 5950
4 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Rockwell Automation Allen-Bradley Stratix 5950
Publisher: ICS-CERT
Operating System: Network Appliance
Impact/Access: Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Mitigation
CVE Names: CVE-2018-0296 CVE-2018-0240 CVE-2018-0231
CVE-2018-0228 CVE-2018-0227
Reference: ESB-2018.1689.2
ESB-2018.1198
Original Bulletin:
https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01
- --------------------------BEGIN INCLUDED TEXT--------------------
Advisory (ICSA-18-184-01)
Rockwell Automation Allen-Bradley Stratix 5950
Original release date: July 03, 2018
Legal Notice
All information products included in http://ics-cert.us-cert.gov are
provided "as is" for informational purposes only. The Department of Homeland
Security (DHS) does not provide any warranties of any kind regarding any
information contained within. DHS does not endorse any commercial product or
service, referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the header.
For more information about TLP, see http://www.us-cert.gov/tlp/.
1. EXECUTIVE SUMMARY
* CVSS v3 8.6
* ATTENTION: Exploitable remotely/low skill level to exploit
* Vendor: Rockwell Automation
* Equipment: Allen-Bradley Stratix 5950
* Vulnerabilities: Improper Input Validation, Improper Certificate
Validation, Resource Management Errors
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to
bypass client certification to create connections to the affected device or
cause the device to crash.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The Allen-Bradley Stratix 5950 uses the Cisco Systems, Inc., Adaptive Security
Appliance (ASA) as its central operating system. Cisco has released advisories
disclosing multiple vulnerabilities in the ASA software.
The following Allen-Bradley Stratix 5950 Security Appliances, running the Cisco
ASA v9.6.2 and earlier, are affected:
* 1783-SAD4T0SBK9,
* 1783-SAD4T0SPK9,
* 1783-SAD2T2SBK9, and
* 1783-SAD2T2SPK9
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER INPUT VALIDATION CWE-20
A vulnerability in the ingress flow creation functionality of the Cisco ASA
could allow an unauthenticated, remote threat actor to cause the CPU to
increase upwards of 100 percent utilization, causing a denial-of-service (DoS)
condition on an affected system.
CVE-2018-0228 has been assigned to this vulnerability. A CVSS v3 base score of
8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N
/I:N/A:H).
3.2.2 IMPROPER CERTIFICATE VALIDATION CWE-295
A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN)
Client Certificate Authentication feature for the Cisco ASA could allow an
unauthenticated, remote threat actor to establish an SSL VPN connection and
bypass certain SSL certificate verification steps.
CVE-2018-0227 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N
/I:H/A:N).
3.2.3 IMPROPER INPUT VALIDATION CWE-20
A vulnerability in the Transport Layer Security library of the Cisco ASA
Software and Cisco Firepower Threat Defense (FTD) Software could allow an
unauthenticated, remote threat actor to trigger a reload of the affected
device, resulting in a DoS condition.
CVE-2018-0231 has been assigned to this vulnerability. A CVSS v3 base score of
8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N
/I:N/A:H).
3.2.4 RESOURCE MANAGEMENT ERRORS CWE-399
Multiple vulnerabilities in the Application Layer Protocol Inspection feature
of the Cisco ASA Software and Cisco FTD Software could allow an
unauthenticated, remote threat actor to trigger a reload of an affected device,
resulting in a DoS condition.
CVE-2018-0240 has been assigned to this vulnerability. A CVSS v3 base score of
8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N
/I:N/A:H).
3.2.5 IMPROPER INPUT VALIDATION CWE-20
A vulnerability in the web interface of the Cisco ASA could allow an
unauthenticated, remote threat actor to cause an affected device to reload
unexpectedly, resulting in a DoS condition. It is also possible on certain
software releases that the ASA will not reload, but a threat actor could view
sensitive system information without authentication by using directory
traversal techniques.
CVE-2018-0296 has been assigned to this vulnerability. A CVSS v3 base score of
8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N
/I:N/A:H).
3.3 BACKGROUND
* CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy, Water and
Wastewater Systems
* COUNTRIES/AREAS DEPLOYED: Worldwide
* COMPANY HEADQUARTERS LOCATION: Wisconsin, USA
3.4 RESEARCHER
Rockwell Automation reported these vulnerabilities to NCCIC.
4. MITIGATIONS
Rockwell Automation will inform users of updated firmware as soon as it is
available. Rockwell Automation recommends that users using affected devices
apply the following risk mitigation strategies:
* CVE-2018-0228 - The ASA and FTD configuration commands-set connection
per-client-embryonic-max (TCP) and set connection per-client-max (TCP, UDP,
and Stream Control Transmission Protocol [SCTP]) can be configured to limit
the number of connection requests allowed. Using these configuration
parameters can reduce the number of connections and greatly reduce the
impact of the DoS attack.
* CVE-2018-0227 - No workarounds available
* CVE-2018-0231 - No workarounds available
* CVE-2018-0240 - No workarounds available
* CVE-2018-0296 - Cisco has released Snort Rule 46897
For additional information please see the Rockwell Automation security
notification at (login required): https://rockwellautomation.custhelp.com/app/
answers/detail/a_id/1073860
Additionally the Cisco advisories can be found at the following links:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20180418-asa2
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20180418-asa1
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20180418-asa3
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20180418-asa_inspect
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20180606-asaftd
NCCIC recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:
* Minimize network exposure for all control system devices and/or systems,
and ensure that they are not accessible from the Internet.
* Locate control system networks and remote devices behind firewalls, and
isolate them from the business network.
* When remote access is required, use secure methods, such as Virtual Private
Networks (VPNs), recognizing that VPNs may have vulnerabilities and should
be updated to the most current version available. Also recognize that VPN
is only as secure as the connected devices.
NCCIC reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available
on the ICS-CERT website in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to NCCIC for tracking
and correlation against other incidents.
NCCIC also recommends that users take the following measures to protect
themselves from social engineering attacks:
* Do not click web links or open unsolicited attachments in email messages.
* Refer to Recognizing and Avoiding Email Scams for more information on
avoiding email scams.
* Refer to Avoiding Social Engineering and Phishing Attacks for more
information on social engineering attacks.
No known public exploits specifically target these vulnerabilities.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWzwoFWaOgq3Tt24GAQhibA//XtMn13N1l18vdOkAa2FGCVYoLjCM5bmP
TRxyMVGhwl2STqpsCOUHWVSKScomfayHpGO5Tr4KV3Ijur5f+HbzeIjgJRWsjYLa
rbC4st0hv8eDNt94BwoGOFesA+4eIm//rXXbRVTUhj9LKbZ/mNr09fEgW/6i5JSE
ZPR4TBQ4p7ylNNmkmB8EM4HsPm3Z7evmDRdmEev1HdcVOhxQn8UipeszPaSyt7Kd
eLUIAJB1E22Q0VjWLho2hN7udugEsIDQG+WwllPYH2GO5WLKsWgtx2nPoui2NFpd
gcmw9jQxq5EHhzETMIcBp5zWJN76ZpLi47+G3lVkiC07LuLQ1u6VDvIgeL3P0aJb
1LQaKYruRdgz3p8tDn6hUzb0gcZnhfzsNbI6lGxYHE4/kTNvpaOhv3s4NBFTXjbC
VSJBEuIX250023210fEkFUtD5fRZihZk1tsSatqE1txYR6+X3sg+O+4ea98CV0xh
RB/Ab5zjk7Vivq4LvOfFAqzNjA/0itTcTNVKtcZIyX08jmlPEfl/Oom5J/NEpwOK
QjtfIxZtDxL3iFMxbDccY7F7u10EB799TPjIpZ+ftHkBnsuCi23MPyhE98tr0vk8
WfMi6UMhOSemXqlsqluApUOCNJMCeQb+yYpUmFJCmz1pn/z3H340Zu8HIC5BC3oL
tG2SjUnmBpg=
=JcN9
-----END PGP SIGNATURE-----