Siemens Workaround for APOGEE Insight

Tuesday, March 22, 2016 @ 06:03 PM gHale


Siemens created a workaround to mitigate an incorrect file permissions vulnerability in APOGEE Insight, according to a report on ICS-CERT.

Network & Information Security Ltd. Company and HuNan Quality Inspection Institute reported this issue directly to Siemens.

RELATED STORIES
ABB Fixes DLL Hijacking Vulnerability
Siemens Fixes SIMATIC S7-1200 Hole
Telvent’s Improper Frame Padding Fixed
Moxa Patches ioLogik Controllers

All versions of APOGEE Insight suffer from the issue.

This vulnerability could allow authenticated users of the operating system to modify application data for the affected product.

Siemens is a multinational company headquartered in Munich, Germany.

The affected product, APOGEE Insight software, provides a graphical interface to manage and control buildings. APOGEE Insight software sees action across several sectors including commercial facilities. Siemens officials said this product sees use on a global basis.

The file permissions set for the APOGEE Insight application folder could allow authenticated operating system users to modify the APOGEE Insight application data if local access ended up obtained.

CVE-2016-3155 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 3.4.

This vulnerability is not exploitable remotely, and an attacker would need to be an authenticated user of the operating system.

No known public exploits specifically target this vulnerability. An attacker with a low skill would be able to exploit this vulnerability.

Siemens is working on a new APOGEE Insight version to resolve the vulnerability, and ICS-CERT will update this advisory as soon as new information becomes available.

Siemens has detailed instructions on how to mitigate the vulnerability by correcting file permissions. To receive these instructions, users should contact their local service organization or a local Siemens hotline center.

For more information on this vulnerability and more detailed mitigation instructions, click on Siemens Security Advisory SSA-151221.