Rockwell Working on Stratix 5950 Fix

Thursday, July 5, 2018 @ 01:07 PM gHale

Rockwell Automation will inform users of updated firmware as soon as it is available to mitigate multiple vulnerabilities in its Allen-Bradley Stratix 5950, according to a report from NCCIC.

The vulnerabilities, which Rockwell self-reported, include improper input validation, improper certificate validation and resource management errors.

RELATED STORIES
Mitigations for Siemens Industrial Plant Clocks
Medtronic Updates for MyCareLink Monitor Holes
Medtronic Updates Carelink Fix
Delta Electronics Fixes Vulnerability

Successful exploitation of these vulnerabilities could allow an attacker to bypass client certification to create connections to the affected device or cause the device to crash.

The Allen-Bradley Stratix 5950 uses the Cisco Systems, Inc., Adaptive Security Appliance (ASA) as its central operating system. Cisco released advisories disclosing multiple vulnerabilities in the ASA software.

The following Allen-Bradley Stratix 5950 Security Appliances, running the Cisco ASA v9.6.2 and earlier, are affected:
• 1783-SAD4T0SBK9
• 1783-SAD4T0SPK9
• 1783-SAD2T2SBK9
• 1783-SAD2T2SPK9

A vulnerability in the ingress flow creation functionality of the Cisco ASA could allow an unauthenticated, remote threat actor to cause the CPU to increase upwards of 100 percent utilization, causing a denial-of-service (DoS) condition on an affected system.

CVE-2018-0228 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.6.

In addition, a vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for the Cisco ASA could allow an unauthenticated, remote threat actor to establish an SSL VPN connection and bypass certain SSL certificate verification steps.

CVE-2018-0227 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.

Also, there is a vulnerability in the Transport Layer Security library of the Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote threat actor to trigger a reload of the affected device, resulting in a DoS condition. 

CVE-2018-0231 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.6.

In addition there are multiple vulnerabilities in the Application Layer Protocol Inspection feature of the Cisco ASA Software and Cisco FTD Software could allow an unauthenticated, remote threat actor to trigger a reload of an affected device, resulting in a DoS condition. 

CVE-2018-0240 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.6.

There is a vulnerability in the web interface of the Cisco ASA could allow an unauthenticated, remote threat actor to cause an affected device to reload unexpectedly, resulting in a DoS condition. It is also possible on certain software releases that the ASA will not reload, but a threat actor could view sensitive system information without authentication by using directory traversal techniques.

CVE-2018-0296 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 8.6.

The products see use in the critical manufacturing, energy, and water and wastewater systems sectors. They also see action on a global basis.

No known public exploits specifically target these vulnerabilities. An attacker with low skill level could leverage the vulnerabilities.

Rockwell will inform users of updated firmware as soon as it is available. Rockwell Automation recommends users using affected devices apply the following risk mitigation strategies:

• CVE-2018-0228 — The ASA and FTD configuration commands—set connection per-client-embryonic-max (TCP) and set connection per-client-max (TCP, UDP, and Stream Control Transmission Protocol [SCTP])—can be configured to limit the number of connection requests allowed. Using these configuration parameters can reduce the number of connections and greatly reduce the impact of the DoS attack.
• CVE-2018-0227 — No workarounds available
• CVE-2018-0231 — No workarounds available
• CVE-2018-0240 — No workarounds available
• CVE-2018-0296 — Cisco released Snort Rule 46897

For additional information see the Rockwell Automation security notification.

Additionally the Cisco advisories can be found at the following links:
Link 1
Link 2
Link 3
Link 4
Link 5

NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.



Leave a Reply

You must be logged in to post a comment.