Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0341
ICSA-12-088-01 ROCKWELL AUTOMATION FACTORYTALK RNADIAGRECEIVER
4 April 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Rockwell Automation FactoryTalk
Publisher: US-CERT
Operating System: Windows
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2012-0222 CVE-2012-0221
Original Bulletin:
http://www.us-cert.gov/control_systems/pdf/ICSA-12-088-01.pdf
Comment: Public exploits are available to target these vulnerabilities.
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS-CERT ADVISORY
ICSA-12-088-01 ROCKWELL AUTOMATION FACTORYTALK RNADIAGRECEIVER
DOS VULNERABILITIES
March 28, 2012
OVERVIEW
This advisory is a follow-up to ICS-CERT Alert ICS-ALERT-12-017-01 - ROCKWELL
AUTOMATION FACTORYTALK RNADIAGRECEIVER [a] that was published January 17, 2012,
on the ICS-CERT web page.
ICS-CERT has coordinated these vulnerabilities with Rockwell Automation who
developed a patch that resolves these vulnerabilities.
AFFECTED PRODUCTS
According to Rockwell Automation's Security Taskforce, the following
Allen-Bradley products are affected by these vulnerabilities:
* RSLogix 5000 (versions 17, 18, 19, 20)
* Factory Talk (CPR9 up to and including CPR9 SR5)
- FT Directory
- FT Alarms & Events
- FT View SE
- FT Diagnostics
- FT Live Data
- FT Server Health.
IMPACT
Successful exploitation of this vulnerability may result in a DoS condition.
Impact to individual organizations depends on many factors that are unique to
each organization.
ICS-CERT recommends that organizations evaluate the impact of these
vulnerabilities based on their operational environment, architecture, and
product implementation.
BACKGROUND
Rockwell Automation provides industrial automation control and information
products worldwide, across a wide range of industries.
The FactoryTalk Services Platform is a collection of production and performance
management systems.
VULNERABILITY CHARACTERIZATION
VULNERABILITY OVERVIEW
UNEXPECTED RETURN VALUE [b]
An unexpected return value can be generated by a specially crafted packet which
can cause the Rockwell Automation FactoryTalk RNADiagReceiver service listening
on Port 4445/TCP to stop processing packets. This vulnerability may lead to a
DoS condition.
CVE-2012-0221 [c] has been assigned to this vulnerability.
READ ACCESS VIOLATION [d]
A read access violation vulnerability exists in Rockwell Automations
FactoryTalk platform. A specially crafted packet can be sent to the
RNADiagReceiver service listening on Port 4445/TCP resulting in a possible DoS
condition.
CVE-2012-0222 [e] has been assigned to this vulnerability.
VULNERABILITY DETAILS
EXPLOITABILITY
These vulnerabilities are remotely exploitable.
EXISTENCE OF EXPLOIT
Public exploits are known that target these vulnerabilities.
DIFFICULTY
An attacker with a low skill level may be able to exploit these
vulnerabilities.
MITIGATION
Rockwell has developed a security update to address these vulnerabilities. To
download and install the update please refer to Rockwells Advisory at
http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937.
For more information on security with Rockwell Automation products, please
refer to Rockwells Security Advisory Index at
http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102.
In addition to applying the above patch, Rockwell Automation recommends
customers configure firewalls to block the following TCP ports to prevent
traversal of RNA messages into and out of the ICS system:
1330
1331
1332
4241
4242
4445
4446
6543
9111
60093
49281.
ICS-CERT encourages asset owners to take additional defensive measures to
protect against this and other cybersecurity risks.
* Minimize network exposure for all control system devices. Critical
devices should not directly face the Internet.
* Locate control system networks and remote devices behind firewalls,
and isolate them from the business network.
* When remote access is required, use secure methods, such as Virtual
Private Networks (VPNs), recognizing that VPN is only as secure as the
connected devices.
The Control Systems Security Program (CSSP) also provides a section for control
systems security recommended practices on the CSSP web page. Several
recommended practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies. [f] ICS-CERT reminds organizations to perform proper impact
analysis and risk assessment prior to taking defensive measures.
In addition, ICS-CERT recommends that users take the following measures to
protect themselves from social engineering attacks:
1. Do not click web links or open unsolicited attachments in e-mail
messages
2. Refer to Recognizing and Avoiding Email Scams [g] for more
information on avoiding e-mail scams
3. Refer to Avoiding Social Engineering and Phishing Attacks [h] for
more information on social engineering attacks.
For any questions related to this report, please contact ICS-CERT at:
E-mail: ics-cert@dhs.gov
Toll Free: 1-877-776-7585
For CSSP Information and Incident Reporting: www.ics-cert.org
DOCUMENT FAQ
What is an ICS-CERT Advisory? An ICS-CERT Advisory is intended to provide
awareness or solicit feedback from critical infrastructure owners and operators
concerning ongoing cyber events or activity with the potential to impact
critical infrastructure computing networks.
When is vulnerability attribution provided to researchers? Attribution for
vulnerability discovery is always provided to the vulnerability reporter
unless the reporter notifies ICS-CERT that they wish to remain anonymous.
ICS-CERT encourages researchers to coordinate vulnerability details before
public release. The public release of vulnerability details prior to the
development of proper mitigations may put industrial control systems and the
public at avoidable risk.
REFERENCES
a. http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-017-01.pdf, date
last accessed March 27, 2012
b. CWE, http://cwe.mitre.org/data/definitions/389.html, CWE-389: Error
Conditions, Return Values, Status Codes. This website last accessed March 27,
2012.
c. CWE, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0221, NIST
uses this advisory to create the CVE website report. This website will be
active sometime after publication of this advisory.
d. CWE, http://cwe.mitre.org/data/definitions/125.html, CWE-125: Out-of-bounds
Read. This website last accessed March 27, 2012.
e. NIST, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0222, NIST
uses this advisory to create the CVE website report. This website will be
active sometime after publication of this advisory.
f. CSSP Recommended Practices,
http://www.us-cert.gov/control_systems/practices/Recommended_Practices.html,
website last accessed March 27, 2012.
g. Recognizing and Avoiding Email Scams,
http://www.us-cert.gov/reading_room/emailscams_0905.pdf, website last accessed
March 27, 2012.
h. National Cyber Alert System Cyber Security Tip ST04-014,
http://www.us-cert.gov/cas/tips/ST04-014.html, website last accessed March 27,
2012.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBT3vPa+4yVqjM2NGpAQJbXA//Xirxl0QI9lYbLqaGk/8Xq0y4OiCQPB8X
SgYRmfM9fnhkDIEmlhyj+KHo5FhQY+wJpNuA8p7iwrmxc4+dZ2jpcf4UVIIC8QUu
jwEQ1EKdjQ1uADxQckb1Kd/1kYHG0eBIdoNyu1ldRpIvTFVliqG0tj1y97KU2vi5
aCQISmtIk20Q/qe0l10fgyY6tuspqz9oXwwTwYEt1PbroHqF6Me4vf3QskV8Z3vw
/8CTtK0klK8VlbF4g5HlnXUyDOgDRbfs/8UZfwm5iHH8CkAtG6rgNq+PjgymGjre
rKfgGIX/DN+xEM7lmTzTyyy0q7kP/yFQ+cBVACUH1oGv1JQsEwIswHzfQF1K3if1
rODy2HYq+AAkCoro1T8zqNJY5vl3JnxR2ZI2ea9G9lOMoImMG8lN5+PlCiF8LUpU
Pd/vJWnSThHwga2Z46V4mdoLRDJwuHo7+xSMrWcArRaIod7wK7ZnjcQ333rz9mN/
4H1VU+41S3nuN3BrTUt7G0XuvthTLBKKihZ+zUwXNYdInoi1UrEaYkGt+GEaAAcw
ctZkWDxN7Z704FsFOBv7DByABGSFckXy319Pih6sDaIYAWBTg7wReJ1ZZoMZ9whv
FoE0UFQZPGg/8fWx3ygVslwzg5YfBz5agdKyNOMW8CQPDWSmpNvPwr3woF5nRdMH
X9YgNN7JHGk=
=ZJSr
-----END PGP SIGNATURE-----