Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2015.2
Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK vulnerabilities
13 January 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Siemens SIMATIC
Siemens SINAMICS
Siemens SINEC
Siemens SINEMA
Siemens SINUMERIK
Publisher: ICS-CERT
Operating System: Network Appliance
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Increased Privileges -- Existing Account
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-7586 CVE-2020-7585 CVE-2020-7580
CVE-2019-8280 CVE-2019-8277 CVE-2019-8276
CVE-2019-8275 CVE-2019-8274 CVE-2019-8273
CVE-2019-8272 CVE-2019-8271 CVE-2019-8270
CVE-2019-8269 CVE-2019-8268 CVE-2019-8267
CVE-2019-8266 CVE-2019-8265 CVE-2019-8264
CVE-2019-8263 CVE-2019-8262 CVE-2019-8261
CVE-2019-8260 CVE-2019-8259 CVE-2019-8258
CVE-2018-15361
Original Bulletin:
https://www.us-cert.gov/ics/advisories/icsa-20-161-04
https://www.us-cert.gov/ics/advisories/icsa-20-161-05
https://www.us-cert.gov/ics/advisories/icsa-20-161-06
Comment: This bulletin contains three (3) ICS-CERT security advisories.
Revision History: January 13 2021: Update E released for ICSA-20-161-04
June 10 2020: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS Advisory (ICSA-20-161-04)
Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update E)
Original release date: January 12, 2021
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided
"as is" for informational purposes only. The Department of Homeland Security
(DHS) does not provide any warranties of any kind regarding any information
contained within. DHS does not endorse any commercial product or service,
referenced in this product or otherwise. Further dissemination of this product
is governed by the Traffic Light Protocol (TLP) marking in the header. For more
information about TLP, see https://us-cert.cisa.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 6.7
o ATTENTION: Low skill level to exploit
o Vendor: Siemens
o Equipment: SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK
o Vulnerability: Unquoted Search Path or Element
2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled
ICSA-20-161-04 Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update D)
that was published December 8, 2020, to the ICS webpage on us-cert.cisa.gov.
3. RISK EVALUATION
Successful exploitation of this vulnerability could allow authorized local
users with administrative privileges to execute custom code with SYSTEM level
privileges.
4. TECHNICAL DETAILS
4.1 AFFECTED PRODUCTS
The following Siemens products are affected:
o SIMATIC Automation Tool: All versions
o SIMATIC NET PC software: All versions after v16 and prior to v16 Upd3
o SIMATIC PCS neo: All versions prior to v3.0 SP1
o SIMATIC ProSave: All versions
o SIMATIC S7-1500 Software Controller: All versions prior to v21.8
o SINAMICS STARTER: All versions prior to v5.4 HF2
o SIMATIC STEP 7: All versions prior to v5.6 SP2 HF3
o SIMATIC STEP 7 (TIA Portal) v13: All versions prior to SP2 Update 4
- --------- Begin Update E Part 1 of 2 ---------
o SIMATIC STEP 7 (TIA Portal) v14: All versions prior to v14 SP1 Update 10
o SIMATIC WinCC Runtime Professional v14: All versions prior to v14 SP1
Update 10
- --------- End Update E Part 1 of 2 ---------
o SIMATIC STEP 7 (TIA Portal) v15: All versions prior to v15.1 Update 5
o SIMATIC STEP 7 (TIA Portal) v16: All versions prior to v16 Update 2
o SIMATIC WinCC OA v3.16: All versions prior to P018
o SIMATIC WinCC OA v3.17: All versions prior to P003
o SIMATIC WinCC Runtime Advanced: All versions prior to v16 Update 2
o SIMATIC WinCC Runtime Professional v13: All versions prior to v13 SP2
Update 4
o SIMATIC WinCC Runtime Professional v14: All versions
o SIMATIC WinCC Runtime Professional v15: All versions prior to v15.1 Update
5
o SIMATIC WinCC Runtime Professional v16: All versions prior to v16 Update 2
o SIMATIC WinCC v7.4: All versions prior to v7.4 SP1 Update 14
o SIMATIC WinCC v7.5: All versions prior to v7.5 SP1 Update 3
o SINAMICS Startdrive: All versions
o SINEC NMS: All versions
o SINEMA Server: All versions
o SINUMERIK ONE virtual: All versions
o SINUMERIK Operate: All versions
4.2 VULNERABILITY OVERVIEW
4.2.1 UNQUOTED SEARCH PATH OR ELEMENT CWE-428
The affected product is vulnerable due to a component within the affected
application that regularly calls a helper binary with SYSTEM privileges while
the call path is not quoted, potentially allowing an attacker to execute
commands with elevated privileges.
CVE-2020-7580 has been assigned to this vulnerability. A CVSS v3 base score of
6.7 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:H/UI:N/S:U/
C:H/I:H/A:H ).
4.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture,
Water and Wastewater Systems
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Germany
4.4 RESEARCHER
Ander Martinez of Titanium Industrial Security and INCIBE reported this
vulnerability to Siemens.
5. MITIGATIONS
Siemens recommends applying updates, where available:
o SIMATIC NET PC software: Update to v16 Upd3
o SIMATIC PCS neo: Update to v3.0 SP1 (Contact your local support to obtain
update software)
o SIMATIC STEP 7: Update to v5.6 SP2 HF3
o SIMATIC WinCC OA v3.16: Update to v3.15-P018 or newer
o SIMATIC WinCC OA v3.17: Update to v3.17-P003 or newer
o SIMATIC WinCC v7.4: Update to v7.4 SP1 Update 14
o SIMATIC WinCC v7.5: Update to v7.5 SP1 Update 3
o SINEC NMS: Install provided patch
o SINEMA Server: Install provided patch
- --------- Begin Update E Part 2 of 2 ---------
o SIMATIC STEP 7 (TIA Portal) v14: Update to v14 SP1 Update 10
o SIMATIC WinCC Runtime Professional v14: Update to v14 SP1 Update 10
- --------- End Update E Part 2 of 2 ---------
Siemens has identified the following specific workarounds and mitigations that
can be applied to reduce the risk:
o Ensure there is no executable at the following locations:
C:\Program.exe
C:\Program Files\Common.exe
C:\Program Files\Common Files\Siemens\Automation\Simatic.exe
o Deactivate the Windows service called TraceConceptX. This leads to loss of
tracing functionality and should only be considered a temporary workaround.
As a general security measure, Siemens strongly recommends protecting network
access to devices with appropriate mechanisms. In order to operate the devices
in a protected IT environment, Siemens recommends configuring the environment
according to the Siemens operational guidelines for Industrial Security and
following the recommendations in the product manuals.
For additional information, please refer to Siemens Security Advisory
SSA-312271
CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.
This vulnerability is not exploitable remotely. No known public exploits
specifically target this vulnerability.
For any questions related to this report, please contact the CISA at:
Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870
CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.
- --------------------------------------------------------------------------------
ICS Advisory (ICSA-20-161-05)
Siemens SIMATIC, SINAMICS
Original release date: June 09, 2020
Legal Notice
All information products included in https://us-cert.gov/ics are provided"as
is" for informational purposes only. The Department of Homeland Security (DHS)
does not provide any warranties of any kind regarding any information contained
within. DHS does not endorse any commercial product or service, referenced in
this product or otherwise. Further dissemination of this product is governed by
the Traffic Light Protocol (TLP) marking in the header. For more information
about TLP, see https://www.us-cert.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 7.8
o ATTENTION: Low skill level to exploit
o Vendor: Siemens
o Equipment: SIMATIC, SINAMICS
o Vulnerabilities: Uncontrolled Search Path Element, Heap-based Buffer
Overflow
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to
affect the availability of the devices under certain conditions.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Siemens products are affected:
o SIMATIC PCS 7: All versions
o SIMATIC PDM: All versions
o SIMATIC STEP 7 v5.X: All versions prior to 5.6 SP2 HF3
o SINAMICS STARTER (containing STEP 7 OEM version): All versions prior to 5.4
HF1
3.2 VULNERABILITY OVERVIEW
3.2.1 UNCONTROLLED SEARCH PATH ELEMENT CWE-427
The affected product is vulnerable to DLL hijacking, which may allow an
attacker with local access to execute code with elevated privileges.
CVE-2020-7585 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).
3.2.2 HEAP-BASED BUFFER OVERFLOW CWE-122
The affected product is vulnerable to a stack-based buffer overflow, which may
allow an attacker with local access to cause a denial-of-service condition.
CVE-2020-7586 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture,
Water and Wastewater Systems
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER
Nadav Erez of Claroty reported these vulnerabilities to Siemens.
4. MITIGATIONS
Siemens recommends applying updates, where available:
o SIMATIC STEP 7 v5.X: Update to v5.6 SP2 HF3 or later
o SINAMICS STARTER (containing STEP 7 OEM version): Update to v5.4 HF1 or
later
Siemens recommends the following to reduce the risk:
o Restrict access to project files on the engineering station to trusted
users.
o Only use project files from trusted sources.
As a general security measure, Siemens strongly recommends protecting network
access to devices with appropriate mechanisms. In order to operate the devices
in a protected IT environment, Siemens recommends configuring the environment
according to the Siemens operational guidelines for Industrial Security and
following the recommendations in the product manuals.
For additional information, please refer to Siemens Security Advisory
SSA-689942
CISA recommends users take the following measures to protect themselves from
social engineering attacks:
o Do not click web links or open unsolicited attachments in email messages.
o Refer to Recognizing and Avoiding Email Scams for more information on
avoiding email scams.
o Refer to Avoiding Social Engineering and Phishing Attacks for more
information on social engineering attacks.
CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.
No known public exploits specifically target these vulnerabilities. These
vulnerabilities are not exploitable remotely.
For any questions related to this report, please contact the CISA at:
Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870
CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.
- --------------------------------------------------------------------------------
ICS Advisory (ICSA-20-161-06)
Siemens SINUMERIK
Original release date: June 09, 2020
Legal Notice
All information products included in https://us-cert.gov/ics are provided"as
is" for informational purposes only. The Department of Homeland Security (DHS)
does not provide any warranties of any kind regarding any information contained
within. DHS does not endorse any commercial product or service, referenced in
this product or otherwise. Further dissemination of this product is governed by
the Traffic Light Protocol (TLP) marking in the header. For more information
about TLP, see https://www.us-cert.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 9.8
o ATTENTION: Exploitable remotely/low skill level to exploit
o Vendor: Siemens
o Equipment: SINUMERIK
o Vulnerabilities: Buffer Underflow, Heap-based Buffer Overflow, Improper
Initialization, Out-of-bounds Read, Stack-based Buffer Overflow, Access of
Memory Location After End of Buffer, Off-by-one Error, Improper Null
Termination, Improper Initialization
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow remote code
execution, information disclosure, and denial-of-service attacks under certain
conditions.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports the vulnerabilities affect the following SINUMERIK products:
o SINUMERIK Access MyMachine/P2P: All versions prior to 4.8
o SINUMERIK PCU base Win10 software/IPC: All versions prior to 14.00
o SINUMERIK PCU base Win7 software/IPC: All versions prior to 12.01 HF4
3.2 VULNERABILITY OVERVIEW
3.2.1 BUFFER UNDERWRITE ('BUFFER UNDERFLOW') CWE-124
The affected products are vulnerable to a buffer underwrite in VNC client code,
which may allow an attacker to remotely execute arbitrary code.
CVE-2018-15361 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.2 HEAP-BASED BUFFER OVERFLOW CWE-122
The affected products are vulnerable to a heap-based buffer overflow, which may
result in code execution.
CVE-2019-8258 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.3 IMPROPER INITIALIZATION CWE-665
The affected products contain multiple memory leaks in VNC client code, which
allow an attacker to read stack memory and can be abused for information
disclosure. Combined with another vulnerability, it can be used to leak stack
memory and bypass ASLR.
CVE-2019-8259 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
3.2.4 OUT-OF-BOUNDS READ CWE-125
There is an out-of-bounds read vulnerability in VNC client decoder code caused
by multiplication overflow.
CVE-2019-8260 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.5 OUT-OF-BOUNDS READ CWE-125
The affected products have an out-of-bounds read vulnerability in VNC code
inside the client decoder, caused by multiplication overflow.
CVE-2019-8261 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.6 HEAP-BASED BUFFER OVERFLOW CWE-122
The affected products have multiple heap buffer overflow vulnerabilities in VNC
client code inside Ultra decoder, which results in code execution.
CVE-2019-8262 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.7 STACK-BASED BUFFER OVERFLOW CWE-121
The affected products are vulnerable to a stack-based buffer overflow, which
leads to a denial-of-service condition. User interaction is required to trigger
this vulnerability.
CVE-2019-8263 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:R/S:U/
C:N/I:N/A:H ).
3.2.8 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788
The affected products are vulnerable due to out-of-bounds access, which can
potentially result in code execution.
CVE-2019-8264 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.9 A ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788
The affected products are vulnerable to multiple out-of-bounds access
vulnerabilities connected with usage of a macro in the VNC client code, which
can potentially result in code execution.
CVE-2019-8265 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.10 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788
The affected products have multiple out-of-bounds access vulnerabilities
connected with improper usage of functions in the VNC client code, which can
potentially result in code execution.
CVE-2019-8266 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.11 OUT-OF-BOUNDS READ CWE-125
The affected products are vulnerable due to an out-of-bounds read in the VNC
client code, which may result in a denial-of-service condition.
CVE-2019-8267 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:N/I:N/A:H ).
3.2.12 OFF-BY-ONE ERROR CWE-193
The affected products have multiple off-by-one vulnerabilities in VNC client
code connected with improper usage of functions, which can potentially result
code execution.
CVE-2019-8268 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.13 STACK-BASED BUFFER OVERFLOW CWE-121
The affected products are vulnerable to a stack-based buffer overflow in the
VNC client code, which may allow an attacker to perform a denial of service
condition.
CVE-2019-8269 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( V:N/AC:L/PR:N/UI:N/S:U/C:N
/I:N/A:H ).
3.2.14 OUT-OF-BOUNDS READ CWE-125
The affected products have an out-of-bounds read vulnerability in VNC client
code inside Ultra decoder, which results in a denial-of-service condition.
CVE-2019-8270 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( V:N/AC:L/PR:N/UI:N/S:U/C:N
/I:N/A:H ).
3.2.15 HEAP-BASED BUFFER OVERFLOW CWE-122
The affected products are vulnerable to a heap-based buffer overflow in the VNC
server code inside the file transfer handler, which can potentially result in
code execution.
CVE-2019-8271 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.16 OFF-BY-ONE ERROR CWE-193
The affected products are vulnerable to multiple off-by-one errors in the VNC
server code, which may allow an attacker to execute arbitrary code.
CVE-2019-8272 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.17 HEAP-BASED BUFFER OVERFLOW CWE-122
The affected products are vulnerable to a heap-based buffer overflow in the VNC
server code inside the file transfer request handler, which can potentially
result in code execution.
CVE-2019-8273 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.18 HEAP-BASED BUFFER OVERFLOW CWE-122
The affected products have a heap buffer overflow vulnerability in VNC server
code inside file transfer offer handler, which can potentially in result code
execution.
CVE-2019-8274 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.19 IMPROPER NULL TERMINATION CWE-170
There is an improper null termination in the VNC server code, which may allow
remote access to out-of-bounds data.
CVE-2019-8275 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.20 STACK-BASED BUFFER OVERFLOW CWE-121
The affected products are vulnerable to a stack-based buffer overflow in the
VNC server code, which can result in denial of service.
CVE-2019-8276 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:N/I:N/A:H ).
3.2.21 IMPROPER INITIALIZATION CWE-665
The affected products contain multiple memory leaks in VNC server code, which
allows an attacker to read stack memory and can be abused for information
disclosure. Combined with another vulnerability, it can be used to leak stack
memory and bypass ASLR.
CVE-2019-8277 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
3.2.22 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788
The affected products are vulnerable to out-of-bounds access in the VNC client,
which can potentially allow code execution.
CVE-2019-8280 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture,
Water and Wastewater Systems
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER
Siemens reported these vulnerabilities to CISA.
4. MITIGATIONS
Siemens has released updates for the affected products and recommends users
update to the latest versions:
o SINUMERIK Access MyMachine/P2P: Update to v4.8 (SINUMERIK software can be
obtained from a Siemens account manager)
o SINUMERIK PCU base Win10 software/IPC: Update to v14.00 (SINUMERIK software
can be obtained from a Siemens account manager)
o SINUMERIK PCU base Win7 software/IPC: Update to v12.01 HF4 (SINUMERIK
software can be obtained from a Siemens account manager)
Siemens recommends the following to help reduce risk:
o Restrict access to the device to the internal or VPN network and to trusted
IP addresses only.
As a general security measure, Siemens strongly recommends protecting network
access to devices with appropriate mechanisms. In order to operate the devices
in a protected IT environment, Siemens recommends configuring the environment
according to the Siemens operational guidelines for Industrial Security and
following the recommendations in the product manuals.
For additional information, please refer to Siemens Security Advisory
SSA-927095
CISA recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:
o Minimize network exposure for all control system devices and/or systems,
and ensure that they are not accessible from the Internet .
o Locate control system networks and remote devices behind firewalls, and
isolate them from the business network.
o When remote access is required, use secure methods, such as Virtual Private
Networks (VPNs), recognizing that VPNs may have vulnerabilities and should
be updated to the most current version available. Also recognize that VPN
is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
For any questions related to this report, please contact the CISA at:
Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870
CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX/6m6eNLKJtyKPYoAQim7xAAgp34dIyLirXbeKPiC6qq7ZQW3+RSBZu+
/1h/VEDumxJxev4bHrtVWHsekYs6Pn5xFGQhl0KBtlIm6lPNi6C+C0lSE5yOswMM
eandr+HQECH9ESOFMwQQ3zTi+d6Ws8OzGzMroH9C+U82nos2aPvd9yzy1Hcc/T1f
mGAxpLL/0sqGY+ZIh6YAfCSDLsKoYc+GozwJxOmMSUyZuC89A5LbcqCvng+AmzBL
qVHLw3ryCnGd9la9tSzVwW5GRrVVsDj2u+RSO3PUbN4f0oE20bgkGyGZSt0PIpWr
MTma9Q0MzxZFDxHHVQ+J0niN3GbgRqzTXRFSn9b4ei0fEDyVqlzKMBDHupTPGv07
YTgw8olJb6Qp395M2BayIP2mz4sTezskZzvcrvPgwFKcxVsU2uv6U/lL0MZf2e+Y
i7PuWdpkLa18KqwXUnrz6hkU1kLz8vNM4/lICDrxCQoe69qfG5WdhXM1aX/2/Q2b
5oYsHijxl8a5YkdzW2eu2FSAR6XDRS97L8Rj4RXg0wTpymFVpEBR5cH8M9gp/cbL
HRFSGktLO1WwZyRCOjhYkYRs1h55ZNyz0j9Ah+s5wuTZeSq7EhY6pp8pbH7uByIe
DasnDElL71Rn3Px0i8ZO2fwm6SOZIW6SqCIUcyPUygN8YHszcBBc5VFjRihHrOuY
Iopig5yMma8=
=kscP
-----END PGP SIGNATURE-----