Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.2346 ICS Advisory (ICSA-19-178-01): ABB PB610 Panel Builder 600 28 June 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: ABB PB610 Panel Builder 600 Publisher: ICS CERT Operating System: Windows Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Increased Privileges -- Remote/Unauthenticated Access Privileged Data -- Remote/Unauthenticated Modify Arbitrary Files -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2019-7232 CVE-2019-7231 CVE-2019-7230 CVE-2019-7228 CVE-2019-7227 CVE-2019-7226 CVE-2019-7225 Original Bulletin: https://www.us-cert.gov/ics/advisories/icsa-19-178-01 - --------------------------BEGIN INCLUDED TEXT-------------------- ICS Advisory (ICSA-19-178-01) ABB PB610 Panel Builder 600 Original release date: June 27, 2019 Legal Notice All information products included in http://ics-cert.us-cert.gov are provided"as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/ . 1. EXECUTIVE SUMMARY o CVSS v3 8.8 o ATTENTION: Low skill level to exploit o Vendor: ABB o Equipment: PB610 Panel Builder 600 o Vulnerabilities: Use of Hard-coded Credentials, Improper Authentication, Relative Path Traversal, Improper Input Validation, Stack-based Buffer Overflow 2. RISK EVALUATION An attacker who successfully exploits these vulnerabilities could prevent legitimate access to an affected system node, remotely cause an affected system node to stop, take control of an affected system node, or insert and run arbitrary code in an affected system node. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of PB610 Panel Builder 600, an engineering tool for designing HMI applications and the runtime for control panels, which are used for the operation of automation systems, are affected: o PB610 Panel Builder 600, order code: 1SAP500900R0101, Versions 1.91 ... 2.8.0.367 and prior. 3.2 VULNERABILITY OVERVIEW 3.2.1 USE OF HARD-CODED CREDENTIALS CWE-798 The ABB CP635 HMI component implements hidden administrative accounts used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. CVE-2019-7225 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.2 IMPROPER AUTHENTICATION CWE-287 The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. CVE-2019-7226 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.3 RELATIVE PATH TRAVERSAL CWE-23 The IDAL FTP server fails to ensure directory change requests do not change to locations outside of the root FTP directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory. CVE-2019-7227 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:L/UI:N/S:U/ C:H/I:H/A:N ). 3.2.4 IMPROPER INPUT VALIDATION CWE-20 The IDAL HTTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server. CVE-2019-7228 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.5 IMPROPER INPUT VALIDATION CWE-20 The IDAL FTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server. CVE-2019-7230 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.6 STACK-BASED BUFFER OVERFLOW CWE-121 The IDAL HTTP server is vulnerable to a stack-based buffer overflow when a large host header is sent in a HTTP request. The host header value overflows a buffer and can overwrite the Structured Exception Handler (SEH) address with a large chunk of data. CVE-2019-7232 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.7 STACK-BASED BUFFER OVERFLOW CWE-121 The IDAL FTP server is vulnerable to a buffer overflow when a large string is sent by an authenticated attacker. This overflow is handled, but terminates the process. CVE-2019-7231 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/ C:N/I:N/A:H ). 3.3 BACKGROUND o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Dams, Energy, Food and Agriculture, Water and Wastewater o COUNTRIES/AREAS DEPLOYED: Worldwide o COMPANY HEADQUARTERS LOCATION: Switzerland 3.4 RESEARCHER Xen1thLabs, a Darkmatter Company, United Arab Emirates, and Abu Dhabi reported these vulnerabilities to ABB. 4. MITIGATIONS The problems are corrected in the following product versions: PB610 Panel Builder 600 v2.8.0.424 . New version of BSP (board support package) UN31 v2.31 . New version of BSP (board support package) UN30 v2.31 . ABB recommends users apply the update of the PB610 applications on CP600 control panels at the earliest convenience. If an update of the devices is not possible. ABB recommends users restrict network access to the devices to only trusted parties/devices. To prevent an unauthorized login via a remote client, leave the "Force Remote Login" option of the security settings checked (default setting). In addition, set new users and passwords in the user's settings for remote clients to "use different user and password." ABB's recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include : o Restrict physical access to process control systems to authorized personnel, o Do not have direct connections to the Internet, o Separate from other networks by means of a firewall system with a minimal number of exposed ports, o Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. o Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. More information on ABB's recommended practices can be found in the following document: 3BSE032547, Whitepaper - Security for Industrial Automation and Control Systems For additional information and support please contact the local ABB service organization. For contact information, see: https://new.abb.com/contact-centers . Information about ABB's cybersecurity program and capabilities can be found at: http://www.abb.com/cybersecurity . For more information see ABB's security advisory 3ADR010377 . NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: o When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices. NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents. No known public exploits specifically target these vulnerabilities. If a control panel with a PB610 HMI application is connected to a network, an attacker who has network access to an affected system node could exploit these vulnerabilities. If the control panel is not connected to a network, an attacker would need to have physical access to an affected system node to exploit these vulnerabilities. For any questions related to this report, please contact the NCCIC at: Email: NCCICCUSTOMERSERVICE@hq.dhs.gov Toll Free: 1-888-282-0870 The NCCIC continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXRVozWaOgq3Tt24GAQjPbg/+PRWf+AEBbVubs8OnKX6mxqlKIxaMwpfb VgZpYei9d+5deyH0QBZlx0zQu57Q1guBMEsOJ3szA/9x8a+q4TzpYKiheCJCzuH8 z/Lor0whkiW9qvbX229PkXB5rQY6rCrVO8s+2RCZFh7CeecG/4RcUlkKah8p3C/L voBQrfpUcYqDwTCHtcZIe2gMYbyTd6oMJV3sAuIapATUyb86bMhJzYANz4oT04u0 7Olz80jthi9bvNPYbAj9myN5gIyvZAsS619SbfebDtmlEywc2bKTUJYgu29891jE 2SW9NQL0uRl+ZDf+RRMGBEZX0baGwdUcQqe7cUGpARe3YQWo2ev++wNxV+vArF8P ATD6RaY73djvgR9EA8fMbbmJBquvG8ovXXB8DGXeGBLRdsbyMhX8FQlGZSD3th1M /QUFP+d6uqZw1oV4mJj7pjTtnHrwDIH3r7SuNFp+rDHCPgkI3SQzRARbaUSvXldK kpPfagoz9umqh4kMyhddZAr7Ev8HNZHvp9EKfzLhzApKYrih9Q0nWOd/FnL3Or7e IGjBrW/7RGxN9w26xzv+hoLbYjpXPfVhOglo6wwjaorSD5q6v6hFNc+ZER7GAn2X OjMI6DypK/sZJMCq0JQiqbCZO5TtQjuVHtYxcximdP1/h24e7e5SuH0WGe0xZR/r +z+jqt2a6Qk= =6DVk -----END PGP SIGNATURE-----