The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · May 24, 2018

Schneider Electric Floating License Manager

Original release date: May 24, 2018
Vulnerabilities: Heap-based Buffer Overflow, Improper Restriction of Operations within the Bounds of a Memory Buffer, Open Redirect
4. MITIGATIONS

Schneider Electric recommends that users of affected Citect and PlantStruxure products download and install the new version of the software located at:
Click to expand...

ronjor · May 24, 2018

Rockwell Automation FactoryTalk Activation Manager (Update A)

Original release date: May 10, 2018 | Last revised: May 24, 2018
Vulnerabilities: Cross-site Scripting, Improper Restriction of Operations within the Bounds of a Memory Buffer
5. MITIGATIONS
Rockwell Automation recommends users with affected versions of CodeMeter and/or FlexNet Publisher that were installed with FactoryTalk Activation Manager to update Factory Talk Activation Manager to v4.02.
Click to expand...

ronjor · May 24, 2018

Siemens Siveillance VMS (Update A)

Original release date: May 08, 2018 | Last revised: May 24, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-128-02 Siemens Siveillance VMS that was published May 8, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · May 24, 2018

Martem TELEM-GW6/GWM (Update A)

Original release date: May 22, 2018 | Last revised: May 24, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-142-01 Martem TELEM-GW6/GWM that was published May 22, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

guest · May 25, 2018

Xenotime Attack Group Expands Activity
May 25, 2018
https://www.infosecurity-magazine.com/news/xenotime-attack-group-expands/

The Xenotime group has been labeled the most dangerous threat activity group because it is the only group intentionally compromising and disrupting industrial safety instrumented systems.

In the December 2017 attack on Schneider Electric’s Triconex safety instrumented system, attackers moved between networks using credential capture and replay after it configured the malware based on the functions of the system within the industrial control (ICS) environment. The level of sophistication noted in the Trisis malware framework indicated that the group had a deep knowledge of the Triconex infrastructure and processes.

In a 24 May blog post, Dragos wrote, “Industrial safety systems are highly redundant and separate controls which override and manage industrial processes if they approach unsafe conditions such as over-pressurization, overspeed, or over-heating. They enable engineers and operators to safely control and possibly shutdown processes before a major incident occurs. They’re a critical component of many dangerous industrial environments such as electric power generation and oil and gas processing.”
Click to expand...

ronjor · May 31, 2018

Yokogawa STARDOM Controllers

Original release date: May 30, 2018 | Last revised: May 31, 2018
Vulnerability: Hard-coded Credentials
4. MITIGATIONS
Yokogawa has recommended users upgrade the FCN/FCJ software to Version R4.10 or later and reports that the vulnerability is remediated in that version. Yokogawa strongly suggests all users introduce appropriate security measures not only for the vulnerability identified but also to the overall system.
Click to expand...

ronjor · May 31, 2018

GE MDS PulseNET and MDS PulseNET Enterprise

Original release date: May 31, 2018
Vulnerabilities: Improper Authentication, Improper Restriction of XML External Entity Reference, Relative Path Traversal
4. MITIGATIONS
GE has modified the product architecture and software of PulseNET. The latest version mitigates these specific vulnerabilities. GE encourages users to update PulseNET to Version 4.1 or newer to eliminate these vulnerabilities.
Click to expand...

ronjor · May 31, 2018

Delta Industrial Automation DOPSoft

Original release date: May 30, 2018 | Last revised: May 31, 2018
Vulnerabilities: Out-of-bounds Read, Heap-based Buffer Overflow, Stack-based Buffer Overflow
4. MITIGATIONS
Delta Electronics recommends affected users update to the latest version found at:
Click to expand...

ronjor · May 31, 2018

Silex Technology SX-500/SD-320AN or GE Healthcare MobileLink (Update A)

Original release date: May 08, 2018 | Last revised: May 31, 2018
Vulnerabilities: Improper Authentication, OS Command Injection
5. MITIGATIONS
Silex Technologies and GE Healthcare recommend the following mitigations:
Click to expand...

ronjor · May 31, 2018

Rockwell Automation FactoryTalk Activation Manager (Update B)

Original release date: May 10, 2018 | Last revised: May 31, 2018
Vulnerabilities: Cross-site Scripting, Improper Restriction of Operations within the Bounds of a Memory Buffer
5. MITIGATIONS
Rockwell Automation recommends users with affected versions of CodeMeter and/or FlexNet Publisher that were installed with FactoryTalk Activation Manager to update Factory Talk Activation Manager to v4.02. If unable to update FactoryTalk Activation Manager to v4.02, update CodeMeter to a compatible version of CodeMeter that is compatible with FactoryTalk Activation Manager.
Click to expand...

ronjor · Jun 5, 2018

Silex Technology SX-500/SD-320AN or GE Healthcare MobileLink (Update B)

Original release date: May 08, 2018 | Last revised: June 05, 2018
Vulnerabilities: Improper Authentication, OS Command Injection
5. MITIGATIONS
Silex Technologies and GE Healthcare recommend the following mitigations:
Click to expand...

ronjor · Jun 5, 2018

Philips' IntelliVue Patient and Avalon Fetal Monitors

Original release date: June 05, 2018
Vulnerabilities: Improper Authentication, Information Exposure, Stack-based Buffer Overflow
4. MITIGATIONS
Philips will provide a remediation patch for specific supported versions, as well as an upgrade path for all versions. Philips will communicate service options to all affected install-base users.
Philips recommends users obtain associated field change and service bulletin information from Philips by accessing their InCenter account at this location
Click to expand...

:

ronjor · Jun 5, 2018

ABB IP Gateway

Original release date: June 05, 2018
Vulnerabilities: Improper Authentication, Cross-site Request Forgery, Unprotected Storage of Credentials
4. MITIGATIONS
ABB recommends users apply the update at earliest convenience. The update is available for download at the product page of the Busch-Jaeger catalogue in the Software section:
Click to expand...

ronjor · Jun 7, 2018

Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway

Original release date: June 07, 2018
Vulnerability: Unquoted Search Path or Element
4. MITIGATIONS
Rockwell Automation recommends all users update to the following RSLinx Classic and FactoryTalk Linx Gateway versions:
Click to expand...

ronjor · Jun 7, 2018

Delta Electronics Delta Industrial Automation TPEditor (Update A)

Original release date: May 17, 2018 | Last revised: June 07, 2018
Vulnerability: Heap-based Buffer Overflow
5. MITIGATIONS
Delta Electronics recommends affected users update to the latest version of Delta Industrial Automation TPEditor, Version 1.90, which is available for download at:
Click to expand...

guest · Jun 7, 2018

Triton ICS Malware Developed Using Legitimate Code
June 7, 2018
https://www.securityweek.com/triton-ics-malware-developed-using-legitimate-code

FireEye’s Advanced Practices Team has conducted a detailed analysis of the threat, which it describes as a malware framework, in an effort to determine when and how it was created.

It’s unclear how the attackers obtained the hardware and software they used to test the malware. They may have purchased it or borrowed it from a government-owned utility. The software could have also been stolen from ICS companies or other organizations that use Triconex controllers.

Specifically, researchers discovered significant similarities between the code found in the malware and code in a legitimate TriStation software file named “tr1com40.dll.”
Click to expand...

ronjor · Jun 12, 2018

Siemens SIMATIC Authentication Bypass (Update D)

Original release date: February 14, 2017 | Last revised: June 12, 2018
Vulnerability: Improper Authentication
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03C Siemens SIMATIC Authentication Bypass that was published November 30, 2017, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Jun 12, 2018

Siemens SIMATIC Authentication Bypass (Update D)

Original release date: February 14, 2017 | Last revised: June 12, 2018
Vulnerability: Improper Authentication
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03C Siemens SIMATIC Authentication Bypass that was published November 30, 2017, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Jun 12, 2018

Siemens SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, and SIMATIC NET PC Software (Update B)

Original release date: March 29, 2018 | Last revised: June 12, 2018
Vulnerability: Improper Input Validation
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-18-088-03 Siemens SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, and SIMATIC NET PC Software (Update A) that was published April 24, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Jun 12, 2018

Siemens SCALANCE X Switches

Original release date: June 12, 2018
Vulnerabilities: Cross-site Scripting
4. MITIGATIONS
Siemens has provided updates for the following products to fix the vulnerabilities:
Click to expand...

ronjor · Jun 12, 2018

Schneider Electric U.motion Builder

Original release date: June 12, 2018
Vulnerabilities: Command Injection, Cross-site Scripting, and Improper Input Validation
5. MITIGATIONS
Schneider Electric has released firmware update Version 1.3.4, which includes fixes for these vulnerabilities. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
Click to expand...

ronjor · Jun 12, 2018

Siemens SIMATIC PCS 7 (Update A)

Original release date: November 02, 2017 | Last revised: June 12, 2018
Vulnerabilities: Improper Input Validation
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-17-306-01 Siemens SIMATIC PCS 7 that was published November 2, 2017, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Jun 14, 2018

Natus Xltek NeuroWorks

Original release date: June 14, 2018
Vulnerabilities: Stack-Based Buffer Overflow, Out-of-Bounds Read
4. MITIGATIONS

Natus has released NeuroWorks/SleepWorks 8.5 GMA 3, a software update with security enhancements to address the vulnerabilities identified in NeuroWorks/SleepWorks 8.
Click to expand...

ronjor · Jun 14, 2018

Siemens SCALANCE X Switches, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C

Original release date: June 14, 2018
Vulnerability: Permissions, Privileges, and Access Controls
4. MITIGATIONS

Siemens has provided updates for the following products to fix the vulnerability:
Click to expand...

ronjor · Jun 14, 2018

Schneider Electric U.motion Builder

Original release date: June 12, 2018 | Last revised: June 14, 2018
Vulnerabilities: Command Injection, Cross-site Scripting, and Improper Input Validation
4. MITIGATIONS

Schneider Electric has released firmware update Version 1.3.4, which includes fixes for these vulnerabilities. It is highly recommended that U.motion Builder users apply the patch in a timely manner.
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches