Siemens Updates Search Path Hole

Monday, March 9, 2015 @ 06:03 PM gHale


Siemens created updates that mitigate a search path vulnerability in the its SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER applications, according to a report on ICS-CERT.

Ivan Sanchez from WiseSecurity Team discovered the search path vulnerabilities.

RELATED STORIES
Siemens Working out GHOST Vulnerability
Schneider Fixes Buffer Overflow
Kepware Fixes Vulnerability
Software Toolbox Mitigates Vulnerability

The following Siemens products suffer from the issue:
• SIMATIC ProSave: All versions prior to V13 SP1
• SIMOTION Scout: All versions prior to V4.4
• STARTER: All versions prior to V4.4 HF3
• SIMATIC CFC:
1. All versions prior to V8.0 SP4
2. CFC V8.0 SP4: all versions prior to V8.0 SP4 Upd 9
3. CFC V8.1: all versions prior to V8.1 Upd1
• SIMATIC STEP 7 V5.5:
1. All versions prior to V5.5 SP1
2. STEP 7 V5.5 SP1: all versions prior to V5.5 SP1 HF2
3. STEP 7 V5.5 SP2: all versions prior to V5.5 SP2 HF7
4. STEP 7 V5.5 SP3: all versions
5. STEP 7 V5.5 SP4: all versions prior to V5.5 SP4 HF4
• SIMATIC PCS 7 (as STEP 7 and CFC are incorporated):
1. All versions prior to V8.0 SP2
2. PCS 7 V8.0 SP2: all versions
3. PCS 7 V8.1: all versions prior to V8.1 with STEP 7 SP4 HF4 and CFC V8.1 Upd1

This vulnerability could allow attackers to execute arbitrary code from files located on the local file system or connected network shares with the privileges of the user running the affected products.

Siemens is a multinational company headquartered in Munich, Germany.

SIMATIC ProSave sees use for backup restore and firmware update for SIMATIC HMI panels. SIMOTION SCOUT is a framework for motion control engineering system tools. STARTER is a drive engineering tool for parameterizing and commissioning. SIMATIC CFC (Continuous Function Chart) is a graphic editor that is a core component of PCS 7 engineering. STEP 7 is Siemens’ engineering software for PLC and hardware configuration. SIMATIC PCS 7 is a distributed control system (DCS) integrating SIMATIC STEP 7 and SIMATIC CFC. According to Siemens, these products see action across several sectors including chemical, energy, food and agriculture, and water and wastewater systems. Siemens said these products see use worldwide.

Insufficiently qualified paths could allow attackers to execute arbitrary code from files located on the local file system or connected network shares with the privileges of the user running the affected products. For successful exploitation an unsuspecting user must end up tricked into opening a manipulated application file.

CVE-2015-1594 is the case number assigned to this vulnerability, which has a CVSS v2 base score of 6.9.

This vulnerability is not exploitable remotely and cannot end up exploited without user interaction. The exploit only triggers when a local user runs the vulnerable application and loads the malformed file.

No known public exploits specifically target this vulnerability.

Crafting a working exploit for this vulnerability would require a moderate amount of skill. Social engineering would be mandatory to convince the user to accept the malformed file. Additional user interaction is a requirement to load the malformed file. This decreases the likelihood of a successful exploit.

Siemens provides updates for the following products and recommends customers to update to the new fixed versions:
• The update for SIMATIC ProSave can be obtained here
• The update for SIMOTION SCOUT can be obtained here
• The update for STARTER can be obtained here
• Updates for SIMATIC STEP 7 and SIMATIC CFC can obtained via customer support

For more information on these vulnerabilities and detailed instructions, please see Siemens Security Advisory SSA-451236.



Leave a Reply

You must be logged in to post a comment.