Hotfix for Siemens SiPass Server

Friday, November 2, 2012 @ 10:11 AM gHale

Siemens has a mitigation a hotfix available for the buffer overflow vulnerability in its SiPass server.

Attacking this remotely exploitable vulnerability, reported by Lucas Apa of IOActive, would allow an attacker to perform a denial of service (DoS) and possibly gain access to the system via remote code execution.

Patch Fixes C3-ilex Holes
Korenix Fixes Vulnerability
GE Mitigates Proficy Holes
SCADA Vulnerability Surfaces

The vulnerability affects the SiPass integrated MP2.6 and earlier.

SiPass integrated is a Windows-based client/server system with a wide range of access control and security features. One component of SiPass integrated is SiPass server, which is part of the central system management.

By sending a specially crafted packet to Port 4343/TCP, an attacker can cause a DoS condition with possible remote code execution. The SiPass server accepts these messages and incorrectly processes them, causing the affected conditions. There is no authentication required to access this affected network port. CVE-2012-5409 is the number assigned to this vulnerability, which has a CVSS v2 base score of 10.0.

Siemens has provided a software hotfix resolving the vulnerability for customers of SiPass integrated MP2.4, MP2.5, and MP2.6.

Contact Siemens customer support for acquiring this hotfix. Siemens recommends users with earlier versions of SiPass integrated to upgrade to one of the above mentioned versions. In addition, the users should configure perimeter firewalls to block Port 4343/TCP to SiPass server.

Leave a Reply

You must be logged in to post a comment.