-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.2015
    Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK vulnerabilities
                               10 June 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Siemens SIMATIC
                   Siemens SINAMICS
                   Siemens SINEC
                   Siemens SINEMA
                   Siemens SINUMERIK
Publisher:         ICS-CERT
Operating System:  Network Appliance
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Increased Privileges            -- Existing Account      
                   Denial of Service               -- Remote/Unauthenticated
                   Access Confidential Data        -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-7586 CVE-2020-7585 CVE-2020-7580
                   CVE-2019-8280 CVE-2019-8277 CVE-2019-8276
                   CVE-2019-8275 CVE-2019-8274 CVE-2019-8273
                   CVE-2019-8272 CVE-2019-8271 CVE-2019-8270
                   CVE-2019-8269 CVE-2019-8268 CVE-2019-8267
                   CVE-2019-8266 CVE-2019-8265 CVE-2019-8264
                   CVE-2019-8263 CVE-2019-8262 CVE-2019-8261
                   CVE-2019-8260 CVE-2019-8259 CVE-2019-8258
                   CVE-2018-15361  

Original Bulletin: 
   https://www.us-cert.gov/ics/advisories/icsa-20-161-04
   https://www.us-cert.gov/ics/advisories/icsa-20-161-05
   https://www.us-cert.gov/ics/advisories/icsa-20-161-06

Comment: This bulletin contains three (3) ICS-CERT security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

ICS Advisory (ICSA-20-161-04)

Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK

Original release date: June 09, 2020

Legal Notice

All information products included in https://us-cert.gov/ics are provided"as
is" for informational purposes only. The Department of Homeland Security (DHS)
does not provide any warranties of any kind regarding any information contained
within. DHS does not endorse any commercial product or service, referenced in
this product or otherwise. Further dissemination of this product is governed by
the Traffic Light Protocol (TLP) marking in the header. For more information
about TLP, see https://www.us-cert.gov/tlp/ .



1. EXECUTIVE SUMMARY

  o CVSS v3 6.7
  o ATTENTION: Low skill level to exploit
  o Vendor: Siemens
  o Equipment: SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK
  o Vulnerability: Unquoted Search Path or Element

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow authorized local
users with administrative privileges to execute custom code with SYSTEM level
privileges.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Siemens products are affected:

  o SIMATIC Automation Tool: All versions
  o SIMATIC NET PC software: All versions after v16 and prior to v16 Upd3
  o SIMATIC PCS 7: All versions
  o SIMATIC PCS neo: All versions
  o SIMATIC ProSave: All versions
  o SIMATIC S7-1500 Software Controller: All versions
  o SIMATIC STEP 7: All versions prior to v5.6 SP2 HF3
  o SIMATIC STEP 7 (TIA Portal) v13: All versions
  o SIMATIC STEP 7 (TIA Portal) v14: All versions
  o SIMATIC STEP 7 (TIA Portal) v15: All versions
  o SIMATIC STEP 7 (TIA Portal) v16: All versions
  o SIMATIC WinCC OA v3.16: All versions prior to P018
  o SIMATIC WinCC OA v3.17: All versions prior to P003
  o SIMATIC WinCC Runtime Professional v13: All versions
  o SIMATIC WinCC Runtime Professional v14: All versions
  o SIMATIC WinCC Runtime Professional v15: All versions
  o SIMATIC WinCC Runtime Professional v16: All versions
  o SIMATIC WinCC v7.4: All versions prior to v7.4 SP1 Update 14
  o SIMATIC WinCC v7.5: All versions prior to v7.5 SP1 Update 3
  o SINAMICS Startdrive: All versions
  o SINEC NMS: All versions
  o SINEMA Server: All versions
  o SINUMERIK ONE virtual: All versions
  o SINUMERIK Operate: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 UNQUOTED SEARCH PATH OR ELEMENT CWE-428

The affected product is vulnerable due to a component within the affected
application that regularly calls a helper binary with SYSTEM privileges while
the call path is not quoted, potentially allowing an attacker to execute
commands with elevated privileges.

CVE-2020-7580 has been assigned to this vulnerability. A CVSS v3 base score of
6.7 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:H/UI:N/S:U/
C:H/I:H/A:H ).

3.3 BACKGROUND

  o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture,
    Water and Wastewater Systems
  o COUNTRIES/AREAS DEPLOYED: Worldwide
  o COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Ander Martinez of Titanium Industrial Security and INCIBE reported this
vulnerability to Siemens.

4. MITIGATIONS

Siemens recommends applying updates, where available:

  o SIMATIC NET PC software: Update to v16 Upd3
  o SIMATIC STEP 7: Update to v5.6 SP2 HF3
  o SIMATIC WinCC OA v3.16: Update to v3.15-P018 or newer
  o SIMATIC WinCC OA v3.17: Update to v3.17-P003 or newer
  o SIMATIC WinCC v7.4: Update to v7.4 SP1 Update 14
  o SIMATIC WinCC v7.5: Update to v7.5 SP1 Update 3
  o SINEC NMS: Install provided patch
  o SINEMA Server: Install provided patch

Siemens has identified the following specific workarounds and mitigations that
can be applied to reduce the risk:

  o Ensure there is no executable at the following locations:
       C:\Program.exe
       C:\Program Files\Common.exe
       C:\Program Files\Common Files\Siemens\Automation\Simatic.exe
  o Deactivate the Windows service called TraceConceptX. This leads to loss of
    tracing functionality and should only be considered a temporary workaround.

As a general security measure, Siemens strongly recommends protecting network
access to devices with appropriate mechanisms. In order to operate the devices
in a protected IT environment, Siemens recommends configuring the environment
according to the Siemens operational guidelines for Industrial Security and
following the recommendations in the product manuals.
For additional information, please refer to Siemens Security Advisory
SSA-312271

CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.

This vulnerability is not exploitable remotely. No known public exploits
specifically target this vulnerability.

For any questions related to this report, please contact the CISA at:

Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870

CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.

- --------------------------------------------------------------------------------

ICS Advisory (ICSA-20-161-05)

Siemens SIMATIC, SINAMICS

Original release date: June 09, 2020

Legal Notice

All information products included in https://us-cert.gov/ics are provided"as
is" for informational purposes only. The Department of Homeland Security (DHS)
does not provide any warranties of any kind regarding any information contained
within. DHS does not endorse any commercial product or service, referenced in
this product or otherwise. Further dissemination of this product is governed by
the Traffic Light Protocol (TLP) marking in the header. For more information
about TLP, see https://www.us-cert.gov/tlp/ .

1. EXECUTIVE SUMMARY

  o CVSS v3 7.8
  o ATTENTION: Low skill level to exploit
  o Vendor: Siemens
  o Equipment: SIMATIC, SINAMICS
  o Vulnerabilities: Uncontrolled Search Path Element, Heap-based Buffer
    Overflow

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to
affect the availability of the devices under certain conditions.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Siemens products are affected:

  o SIMATIC PCS 7: All versions
  o SIMATIC PDM: All versions
  o SIMATIC STEP 7 v5.X: All versions prior to 5.6 SP2 HF3
  o SINAMICS STARTER (containing STEP 7 OEM version): All versions prior to 5.4
    HF1

3.2 VULNERABILITY OVERVIEW

3.2.1 UNCONTROLLED SEARCH PATH ELEMENT CWE-427

The affected product is vulnerable to DLL hijacking, which may allow an
attacker with local access to execute code with elevated privileges.

CVE-2020-7585 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).

3.2.2 HEAP-BASED BUFFER OVERFLOW CWE-122

The affected product is vulnerable to a stack-based buffer overflow, which may
allow an attacker with local access to cause a denial-of-service condition.

CVE-2020-7586 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).

3.3 BACKGROUND

  o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture,
    Water and Wastewater Systems
  o COUNTRIES/AREAS DEPLOYED: Worldwide
  o COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Nadav Erez of Claroty reported these vulnerabilities to Siemens.

4. MITIGATIONS

Siemens recommends applying updates, where available:

  o SIMATIC STEP 7 v5.X: Update to v5.6 SP2 HF3 or later
  o SINAMICS STARTER (containing STEP 7 OEM version): Update to v5.4 HF1 or
    later

Siemens recommends the following to reduce the risk:

  o Restrict access to project files on the engineering station to trusted
    users.
  o Only use project files from trusted sources.

As a general security measure, Siemens strongly recommends protecting network
access to devices with appropriate mechanisms. In order to operate the devices
in a protected IT environment, Siemens recommends configuring the environment
according to the Siemens operational guidelines for Industrial Security and
following the recommendations in the product manuals.

For additional information, please refer to Siemens Security Advisory
SSA-689942

CISA recommends users take the following measures to protect themselves from
social engineering attacks:

  o Do not click web links or open unsolicited attachments in email messages.
  o Refer to Recognizing and Avoiding Email Scams for more information on
    avoiding email scams.
  o Refer to Avoiding Social Engineering and Phishing Attacks for more
    information on social engineering attacks.

CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.

No known public exploits specifically target these vulnerabilities. These
vulnerabilities are not exploitable remotely.

For any questions related to this report, please contact the CISA at:

Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870

CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.

- --------------------------------------------------------------------------------

ICS Advisory (ICSA-20-161-06)

Siemens SINUMERIK

Original release date: June 09, 2020

Legal Notice

All information products included in https://us-cert.gov/ics are provided"as
is" for informational purposes only. The Department of Homeland Security (DHS)
does not provide any warranties of any kind regarding any information contained
within. DHS does not endorse any commercial product or service, referenced in
this product or otherwise. Further dissemination of this product is governed by
the Traffic Light Protocol (TLP) marking in the header. For more information
about TLP, see https://www.us-cert.gov/tlp/ .

1. EXECUTIVE SUMMARY

  o CVSS v3 9.8
  o ATTENTION: Exploitable remotely/low skill level to exploit
  o Vendor: Siemens
  o Equipment: SINUMERIK
  o Vulnerabilities: Buffer Underflow, Heap-based Buffer Overflow, Improper
    Initialization, Out-of-bounds Read, Stack-based Buffer Overflow, Access of
    Memory Location After End of Buffer, Off-by-one Error, Improper Null
    Termination, Improper Initialization

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow remote code
execution, information disclosure, and denial-of-service attacks under certain
conditions.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports the vulnerabilities affect the following SINUMERIK products:

  o SINUMERIK Access MyMachine/P2P: All versions prior to 4.8
  o SINUMERIK PCU base Win10 software/IPC: All versions prior to 14.00
  o SINUMERIK PCU base Win7 software/IPC: All versions prior to 12.01 HF4

3.2 VULNERABILITY OVERVIEW

3.2.1 BUFFER UNDERWRITE ('BUFFER UNDERFLOW') CWE-124

The affected products are vulnerable to a buffer underwrite in VNC client code,
which may allow an attacker to remotely execute arbitrary code.

CVE-2018-15361 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.2 HEAP-BASED BUFFER OVERFLOW CWE-122

The affected products are vulnerable to a heap-based buffer overflow, which may
result in code execution.

CVE-2019-8258 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.3 IMPROPER INITIALIZATION CWE-665

The affected products contain multiple memory leaks in VNC client code, which
allow an attacker to read stack memory and can be abused for information
disclosure. Combined with another vulnerability, it can be used to leak stack
memory and bypass ASLR.

CVE-2019-8259 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:N/A:N ).

3.2.4 OUT-OF-BOUNDS READ CWE-125

There is an out-of-bounds read vulnerability in VNC client decoder code caused
by multiplication overflow.

CVE-2019-8260 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.5 OUT-OF-BOUNDS READ CWE-125

The affected products have an out-of-bounds read vulnerability in VNC code
inside the client decoder, caused by multiplication overflow.

CVE-2019-8261 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.6 HEAP-BASED BUFFER OVERFLOW CWE-122

The affected products have multiple heap buffer overflow vulnerabilities in VNC
client code inside Ultra decoder, which results in code execution.

CVE-2019-8262 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.7 STACK-BASED BUFFER OVERFLOW CWE-121

The affected products are vulnerable to a stack-based buffer overflow, which
leads to a denial-of-service condition. User interaction is required to trigger
this vulnerability.

CVE-2019-8263 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:R/S:U/
C:N/I:N/A:H ).

3.2.8 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788

The affected products are vulnerable due to out-of-bounds access, which can
potentially result in code execution.

CVE-2019-8264 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.9 A ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788

The affected products are vulnerable to multiple out-of-bounds access
vulnerabilities connected with usage of a macro in the VNC client code, which
can potentially result in code execution.

CVE-2019-8265 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.10 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788

The affected products have multiple out-of-bounds access vulnerabilities
connected with improper usage of functions in the VNC client code, which can
potentially result in code execution.

CVE-2019-8266 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.11 OUT-OF-BOUNDS READ CWE-125

The affected products are vulnerable due to an out-of-bounds read in the VNC
client code, which may result in a denial-of-service condition.

CVE-2019-8267 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:N/I:N/A:H ).

3.2.12 OFF-BY-ONE ERROR CWE-193

The affected products have multiple off-by-one vulnerabilities in VNC client
code connected with improper usage of functions, which can potentially result
code execution.

CVE-2019-8268 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.13 STACK-BASED BUFFER OVERFLOW CWE-121

The affected products are vulnerable to a stack-based buffer overflow in the
VNC client code, which may allow an attacker to perform a denial of service
condition.

CVE-2019-8269 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( V:N/AC:L/PR:N/UI:N/S:U/C:N
/I:N/A:H ).

3.2.14 OUT-OF-BOUNDS READ CWE-125

The affected products have an out-of-bounds read vulnerability in VNC client
code inside Ultra decoder, which results in a denial-of-service condition.

CVE-2019-8270 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( V:N/AC:L/PR:N/UI:N/S:U/C:N
/I:N/A:H ).

3.2.15 HEAP-BASED BUFFER OVERFLOW CWE-122

The affected products are vulnerable to a heap-based buffer overflow in the VNC
server code inside the file transfer handler, which can potentially result in
code execution.

CVE-2019-8271 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.16 OFF-BY-ONE ERROR CWE-193

The affected products are vulnerable to multiple off-by-one errors in the VNC
server code, which may allow an attacker to execute arbitrary code.

CVE-2019-8272 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.17 HEAP-BASED BUFFER OVERFLOW CWE-122

The affected products are vulnerable to a heap-based buffer overflow in the VNC
server code inside the file transfer request handler, which can potentially
result in code execution.

CVE-2019-8273 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.18 HEAP-BASED BUFFER OVERFLOW CWE-122

The affected products have a heap buffer overflow vulnerability in VNC server
code inside file transfer offer handler, which can potentially in result code
execution.

CVE-2019-8274 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.19 IMPROPER NULL TERMINATION CWE-170

There is an improper null termination in the VNC server code, which may allow
remote access to out-of-bounds data.

CVE-2019-8275 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.2.20 STACK-BASED BUFFER OVERFLOW CWE-121

The affected products are vulnerable to a stack-based buffer overflow in the
VNC server code, which can result in denial of service.

CVE-2019-8276 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:N/I:N/A:H ).

3.2.21 IMPROPER INITIALIZATION CWE-665

The affected products contain multiple memory leaks in VNC server code, which
allows an attacker to read stack memory and can be abused for information
disclosure. Combined with another vulnerability, it can be used to leak stack
memory and bypass ASLR.

CVE-2019-8277 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:N/A:N ).

3.2.22 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788

The affected products are vulnerable to out-of-bounds access in the VNC client,
which can potentially allow code execution.

CVE-2019-8280 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).

3.3 BACKGROUND

  o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture,
    Water and Wastewater Systems
  o COUNTRIES/AREAS DEPLOYED: Worldwide
  o COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has released updates for the affected products and recommends users
update to the latest versions:

  o SINUMERIK Access MyMachine/P2P: Update to v4.8 (SINUMERIK software can be
    obtained from a Siemens account manager)
  o SINUMERIK PCU base Win10 software/IPC: Update to v14.00 (SINUMERIK software
    can be obtained from a Siemens account manager)
  o SINUMERIK PCU base Win7 software/IPC: Update to v12.01 HF4 (SINUMERIK
    software can be obtained from a Siemens account manager)

Siemens recommends the following to help reduce risk:

  o Restrict access to the device to the internal or VPN network and to trusted
    IP addresses only.

As a general security measure, Siemens strongly recommends protecting network
access to devices with appropriate mechanisms. In order to operate the devices
in a protected IT environment, Siemens recommends configuring the environment
according to the Siemens operational guidelines for Industrial Security and
following the recommendations in the product manuals.

For additional information, please refer to Siemens Security Advisory
SSA-927095

CISA recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:

  o Minimize network exposure for all control system devices and/or systems,
    and ensure that they are not accessible from the Internet .
  o Locate control system networks and remote devices behind firewalls, and
    isolate them from the business network.
  o When remote access is required, use secure methods, such as Virtual Private
    Networks (VPNs), recognizing that VPNs may have vulnerabilities and should
    be updated to the most current version available. Also recognize that VPN
    is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.

No known public exploits specifically target these vulnerabilities.

For any questions related to this report, please contact the CISA at:

Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870

CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXuBqmeNLKJtyKPYoAQisNQ//WVyCzGjDuxOTqvWrg56ie3jLiA5tRVz/
Xm7929UUahKNJpd0u7bxV0fDDgHc5B27fHWQMSPg5UwcWYq1yJyyev91lsotTS4t
iY8zs7Cy3ox8DbpG+zkolcrsT137s5amPBxBnM6PCdM4JA86++6A3NtIy4yP3pKM
qqsyTuArrk3likuZqZm/l4fWbSZ1NoV805wHxcDxTD2jQ1rb+Ibq4PD7eFrjXbWq
J8b9KPpaq9bQMVzf+lM1PF3BbkkPFOkZxfei6TW6yBiLAADK5TGrY3B6sqyOMKGQ
BIK9pTC+5RNfqnVHDa3KR5PZXWj/z3kgU8O8uB8sdZYtPcPTGaMS5Y5pDWaQDcCC
OiEfZqfRNDud6vZNqNfH1HSwOMXh1Bnz6W3UmARMNyYdDUbXE4qHMSlBh3HYRkLm
4coZfNgtOfBlo/J+xo1uZHGawWeGx6NCSxZytQInCIKjku30WFY/bMeEi4aJxkNW
cO1oz7SceLKG7TpCPmyYihkplLpZfuPTlx3l7xlDazxiBtjpV1pUxq/HjRV2GZ9t
NZvLhC5P36EdER3XZaskJehqFXf7hAVj0aXqr3uybPlJijX/KxmWGjaYnXTvvt4S
yFGrx7YB7qhddPRonXorK4NYfhB0vPeQ1aT4kqDnDnqiKGuheA8xtZX95bskEKXl
4gPnxwiqk88=
=CLNr
-----END PGP SIGNATURE-----