-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.2346
        ICS Advisory (ICSA-19-178-01): ABB PB610 Panel Builder 600
                               28 June 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           ABB PB610 Panel Builder 600
Publisher:         ICS CERT
Operating System:  Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Increased Privileges            -- Remote/Unauthenticated
                   Access Privileged Data          -- Remote/Unauthenticated
                   Modify Arbitrary Files          -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-7232 CVE-2019-7231 CVE-2019-7230
                   CVE-2019-7228 CVE-2019-7227 CVE-2019-7226
                   CVE-2019-7225  

Original Bulletin: 
   https://www.us-cert.gov/ics/advisories/icsa-19-178-01

- --------------------------BEGIN INCLUDED TEXT--------------------

ICS Advisory (ICSA-19-178-01)

ABB PB610 Panel Builder 600

Original release date: June 27, 2019

Legal Notice

All information products included in http://ics-cert.us-cert.gov are
provided"as is" for informational purposes only. The Department of Homeland
Security (DHS) does not provide any warranties of any kind regarding any
information contained within. DHS does not endorse any commercial product or
service, referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the header.
For more information about TLP, see http://www.us-cert.gov/tlp/ .



1. EXECUTIVE SUMMARY

  o CVSS v3 8.8
  o ATTENTION: Low skill level to exploit
  o Vendor: ABB
  o Equipment: PB610 Panel Builder 600
  o Vulnerabilities: Use of Hard-coded Credentials, Improper Authentication,
    Relative Path Traversal, Improper Input Validation, Stack-based Buffer
    Overflow

2. RISK EVALUATION

An attacker who successfully exploits these vulnerabilities could prevent
legitimate access to an affected system node, remotely cause an affected system
node to stop, take control of an affected system node, or insert and run
arbitrary code in an affected system node.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of PB610 Panel Builder 600, an engineering tool for
designing HMI applications and the runtime for control panels, which are used
for the operation of automation systems, are affected:

  o PB610 Panel Builder 600, order code: 1SAP500900R0101, Versions 1.91 ...
    2.8.0.367 and prior.

3.2 VULNERABILITY OVERVIEW

3.2.1 USE OF HARD-CODED CREDENTIALS CWE-798

The ABB CP635 HMI component implements hidden administrative accounts used
during the provisioning phase of the HMI interface. These credentials allow the
provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS
coils) mapping to the HMI. These credentials are used over both HTTP(S) and
FTP. There is no option to disable or change these undocumented credentials.

CVE-2019-7225 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.2 IMPROPER AUTHENTICATION CWE-287

The IDAL HTTP server CGI interface contains a URL, which allows an
unauthenticated attacker to bypass authentication and gain access to privileged
functions.

CVE-2019-7226 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.3 RELATIVE PATH TRAVERSAL CWE-23

The IDAL FTP server fails to ensure directory change requests do not change to
locations outside of the root FTP directory. An authenticated attacker can
simply traverse outside the server root directory by changing the directory.

CVE-2019-7227 has been assigned to this vulnerability. A CVSS v3 base score of
7.3 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:N ).

3.2.4 IMPROPER INPUT VALIDATION CWE-20

The IDAL HTTP server is vulnerable to memory corruption through insecure use of
user supplied format strings. An attacker can abuse this functionality to
bypass authentication or execute code on the server.

CVE-2019-7228 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.5 IMPROPER INPUT VALIDATION CWE-20

The IDAL FTP server is vulnerable to memory corruption through insecure use of
user supplied format strings. An attacker can abuse this functionality to
bypass authentication or execute code on the server.

CVE-2019-7230 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.6 STACK-BASED BUFFER OVERFLOW CWE-121

The IDAL HTTP server is vulnerable to a stack-based buffer overflow when a
large host header is sent in a HTTP request. The host header value overflows a
buffer and can overwrite the Structured Exception Handler (SEH) address with a
large chunk of data.

CVE-2019-7232 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.7 STACK-BASED BUFFER OVERFLOW CWE-121

The IDAL FTP server is vulnerable to a buffer overflow when a large string is
sent by an authenticated attacker. This overflow is handled, but terminates the
process.

CVE-2019-7231 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:N/I:N/A:H ).

3.3 BACKGROUND

  o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Dams,
    Energy, Food and Agriculture, Water and Wastewater
  o COUNTRIES/AREAS DEPLOYED: Worldwide
  o COMPANY HEADQUARTERS LOCATION: Switzerland

3.4 RESEARCHER

Xen1thLabs, a Darkmatter Company, United Arab Emirates, and Abu Dhabi reported
these vulnerabilities to ABB.

4. MITIGATIONS

The problems are corrected in the following product versions:

PB610 Panel Builder 600 v2.8.0.424 .

New version of BSP (board support package) UN31 v2.31 .

New version of BSP (board support package) UN30 v2.31 .

ABB recommends users apply the update of the PB610 applications on CP600
control panels at the earliest convenience.

If an update of the devices is not possible. ABB recommends users restrict
network access to the devices to only trusted parties/devices.

To prevent an unauthorized login via a remote client, leave the "Force Remote
Login" option of the security settings checked (default setting). In addition,
set new users and passwords in the user's settings for remote clients to "use
different user and password."

ABB's recommended security practices and firewall configurations can help
protect a process control network from attacks that originate from outside the
network. Such practices include :

  o Restrict physical access to process control systems to authorized
    personnel,
  o Do not have direct connections to the Internet,
  o Separate from other networks by means of a firewall system with a minimal
    number of exposed ports,
  o Process control systems should not be used for Internet surfing, instant
    messaging, or receiving e-mails.
  o Portable computers and removable storage media should be carefully scanned
    for viruses before they are connected to a control system.

More information on ABB's recommended practices can be found in the following
document:

3BSE032547, Whitepaper - Security for Industrial Automation and Control Systems

For additional information and support please contact the local ABB service
organization. For contact information, see: https://new.abb.com/contact-centers
.

Information about ABB's cybersecurity program and capabilities can be found at:
http://www.abb.com/cybersecurity .

For more information see ABB's security advisory 3ADR010377 .

NCCIC recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:

  o When remote access is required, use secure methods, such as Virtual Private
    Networks (VPNs), recognizing that VPNs may have vulnerabilities and should
    be updated to the most current version available. Also recognize that VPN
    is only as secure as the connected devices.

NCCIC reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

NCCIC also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .

Additional mitigation guidance and recommended practices are publicly available
on the ICS-CERT website in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to NCCIC for tracking
and correlation against other incidents.

No known public exploits specifically target these vulnerabilities. If a
control panel with a PB610 HMI application is connected to a network, an
attacker who has network access to an affected system node could exploit these
vulnerabilities. If the control panel is not connected to a network, an
attacker would need to have physical access to an affected system node to
exploit these vulnerabilities.

For any questions related to this report, please contact the NCCIC at:

Email: NCCICCUSTOMERSERVICE@hq.dhs.gov
Toll Free: 1-888-282-0870

The NCCIC continuously strives to improve its products and services. You can
help by choosing one of the links below to provide feedback about this product.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXRVozWaOgq3Tt24GAQjPbg/+PRWf+AEBbVubs8OnKX6mxqlKIxaMwpfb
VgZpYei9d+5deyH0QBZlx0zQu57Q1guBMEsOJ3szA/9x8a+q4TzpYKiheCJCzuH8
z/Lor0whkiW9qvbX229PkXB5rQY6rCrVO8s+2RCZFh7CeecG/4RcUlkKah8p3C/L
voBQrfpUcYqDwTCHtcZIe2gMYbyTd6oMJV3sAuIapATUyb86bMhJzYANz4oT04u0
7Olz80jthi9bvNPYbAj9myN5gIyvZAsS619SbfebDtmlEywc2bKTUJYgu29891jE
2SW9NQL0uRl+ZDf+RRMGBEZX0baGwdUcQqe7cUGpARe3YQWo2ev++wNxV+vArF8P
ATD6RaY73djvgR9EA8fMbbmJBquvG8ovXXB8DGXeGBLRdsbyMhX8FQlGZSD3th1M
/QUFP+d6uqZw1oV4mJj7pjTtnHrwDIH3r7SuNFp+rDHCPgkI3SQzRARbaUSvXldK
kpPfagoz9umqh4kMyhddZAr7Ev8HNZHvp9EKfzLhzApKYrih9Q0nWOd/FnL3Or7e
IGjBrW/7RGxN9w26xzv+hoLbYjpXPfVhOglo6wwjaorSD5q6v6hFNc+ZER7GAn2X
OjMI6DypK/sZJMCq0JQiqbCZO5TtQjuVHtYxcximdP1/h24e7e5SuH0WGe0xZR/r
+z+jqt2a6Qk=
=6DVk
-----END PGP SIGNATURE-----