-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.2733
               Lynxspring JENEsys BAS Bridge Vulnerabilities
                             16 November 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Lynxspring JENEsys BAS Bridge
Publisher:         ICS-CERT
Operating System:  Network Appliance
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account            
                   Cross-site Request Forgery      -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-8378 CVE-2016-8369 CVE-2016-8361
                   CVE-2016-8357  

Original Bulletin: 
   https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01

- --------------------------BEGIN INCLUDED TEXT--------------------

Advisory (ICSA-16-320-01)

Lynxspring JENEsys BAS Bridge Vulnerabilities

Original release date: November 15, 2016

Legal Notice

All information products included in http://ics-cert.us-cert.gov are provided
"as is" for informational purposes only. The Department of Homeland Security
(DHS) does not provide any warranties of any kind regarding any information
contained within. DHS does not endorse any commercial product or service,
referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the
header. For more information about TLP, see http://www.us-cert.gov/tlp/.

OVERVIEW

Independent researcher Maxim Rupp has identified several vulnerabilities in
Lynxspring's JENEsys BAS Bridge application. Lynxspring has discontinued
the BAS Bridge application and recommends that users upgrade to the Onyxx
Bridge product.

These vulnerabilities could be exploited remotely.

AFFECTED PRODUCTS

The following BAS Bridge versions are affected:

     BAS Bridge versions 1.1.8 and older.

IMPACT

Attackers are able to change permissions and access controls and also gain
access to the system. They are also able to retrieve credentials. The
application transmits or stores authentication credentials and uses an
insecure method that is susceptible to unauthorized interception and/or
retrieval. The application also does not properly verify requests allowing
attackers to use a cross-site request forgery.

Impact to individual organizations depends on many factors that are unique
to each organization. NCCIC/ICS-CERT recommends that organizations evaluate
the impact of these vulnerabilities based on their operational environment,
architecture, and product implementation.

BACKGROUND

Lynxspring is a US-based company that maintains offices in Lee's Summit,
Missouri.

The affected product, BAS Bridge, is a web-based SCADA system. According
to Lynxspring, BAS Server is deployed across several sectors including
Commercial Facilities, Critical Manufacturing, Energy, Water and Wastewater
Systems, and others. Lynxspring estimates that this product is used
primarily in the United States.

VULNERABILITY CHARACTERIZATION

VULNERABILITY OVERVIEW

PERMISSIONS, PRIVILEGES, AND ACCESS CONTROLS[a]

A user with read-only access can send commands to the software and the
application will accept those commands. This would allow an attacker with
read-only access to make changes within the application.

CVE-2016-8357[b] has been assigned to this vulnerability. A CVSS
v3 base score of 7.1 has been assigned; the CVSS vector string is
(AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).[c]

MISSING AUTHENTICATION FOR CRITICAL FUNCTION[d]

The application uses a hard-coded username with no password allowing an
attacker into the system without authentication.

CVE-2016-8361[e] has been assigned to this vulnerability. A CVSS
v3 base score of 8.6 has been assigned; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).[f]

INSUFFICIENTLY PROTECTED CREDENTIALS[g]

The application's database lacks sufficient safeguards for protecting
credentials.

CVE-2016-8378[h] has been assigned to this vulnerability. A CVSS
v3 base score of 9.8 has been assigned; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).[i]

CROSS-SITE REQUEST FORGERY (CSRF)[j]

The application does not sufficiently verify if a request was intentionally
provided by the user who submitted the request.

CVE-2016-8369[k] has been assigned to this vulnerability. A CVSS
v3 base score of 9.8 has  been assigned; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).[l]

VULNERABILITY DETAILS

EXPLOITABILITY

These vulnerabilities could be exploited remotely.

EXISTENCE OF EXPLOIT

No known public exploits specifically target these vulnerabilities.

DIFFICULTY

An attacker with a low skill would be able to exploit these vulnerabilities.

MITIGATION

Lynxspring recommends replacing existing BAS Bridge installations with the
Onyxx Bridge product. The Onyxx Bridge product has been tested by Lynxspring
to be free of the existing vulnerabilities in the old product. BAS Bridge
has been end of life since 2014 and no further updates will be issued.

ICS-CERT recommends that users take defensive measures to minimize the
risk of exploitation of these vulnerabilities. Specifically, users should:

    Minimize network exposure for all control system devices and/or systems,
    and ensure that they are not accessible from the Internet.
    Locate control system networks and remote devices behind firewalls,
    and isolate them from the business network.
    When remote access is required, use secure methods, such as Virtual
    Private Networks (VPNs), recognizing that VPNs may have vulnerabilities
    and should be updated to the most current version available. Also
    recognize that VPN is only as secure as the connected devices.

ICS-CERT reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

ICS-CERT also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are
available for reading and download, including Improving Industrial Control
Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are
publicly available in the ICS-CERT Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies, that is available for download from the ICS-CERT web site.

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to ICS-CERT for
tracking and correlation against other incidents.

    a.
    CWE-264: Permissions, Privileges, and Access Controls,
    https://cwe.mitre.org/data/definitions/264.html, web site last accessed
    November 15, 2016.
    b.
    NVD, https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8357,
    NIST uses this advisory to create the CVE web site report. This web
    site will be active sometime after publication of this advisory.
    c.
    CVSS Calculator,
    https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S...,
    web site last accessed November 15, 2016.
    d.
    CWE-306: Missing Authentication for Critical Function,
    https://cwe.mitre.org/data/definitions/306.html, web site last accessed
    November 15, 2016.
    e.
    NVD, https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8361,
    NIST uses this advisory to create the CVE web site report. This web
    site will be active sometime after publication of this advisory.
    f.
    CVSS Calculator,
    https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S...,
    web site last accessed November 15, 2016.
    g.
    CWE-522: Insufficiently Protected Credentials,
    https://cwe.mitre.org/data/definitions/522.html, web site last accessed
    November 15, 2016.
    h.
    NVD, https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8378,
    NIST uses this advisory to create the CVE web site report. This web
    site will be active sometime after publication of this advisory.
    i.
    CVSS Calculator,
    https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S...,
    web site last accessed November 15, 2016.
    j.
    CWE-352: Cross-Site Request Forgery (CSRF),
    https://cwe.mitre.org/data/definitions/352.html, web site last accessed
    November 15, 2016.
    k.
    NVD, https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8369,
    NIST uses this advisory to create the CVE web site report. This web
    site will be active sometime after publication of this advisory.
    l.
    CVSS Calculator,
    https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S...,
    web site last accessed November 15, 2016.


Contact Information

For any questions related to this report, please contact ICS-CERT at:

Email: ics-cert@hq.dhs.gov
Toll Free: 1-877-776-7585
International Callers: (208) 526-0900

For industrial control systems security information and incident reporting:
http://ics-cert.us-cert.gov

ICS-CERT continuously strives to improve its products and services. You
can help by choosing one of the links below to provide feedback about
this product.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWCvCw4x+lLeg9Ub1AQi+mhAArPH8IxqjMrMfLTQ8Bhdjx3hkW9AaWNp4
pIVXAEsKhKf7ojMZPUk1gndO7oa91vtf9zS6h1HY42lPoLK9/BpxFHMKqQWf8Oby
SPUoS1n6KyBRW+9oz4iC7Tbk1XpVlNsqxEWnZpRusBxkEEx57DWq3RrHaHYkhxKg
l7NuNKNMWFVrDsqYXgz32bJoFj5SVy+tGcYgw8AWejG0Y7AtImOYHfpmCp+fFEiO
ogKjijnT5uwrZGdq2DE4AIGC+sXkgi5RH5DcWtfzdfVpNOYpvsbzuyuNjU7UHv32
/hFF/WMlyWI5YEyR/OviVlKIqP42W8NX3zzdoIv265uXfDMMei34Cq5qtw4MiaQy
aEBYPPvtAs1ymzoqCozGjOd9ugaoyzvYy6g2BBzbKuTscs0JVXEF3esxbVkBkJJi
bzo3SnWKbPYeMnrmUwMMLG/NgihEfkIQl8eZtWoeDD7cGNRvyDlrR8/9BRRQu2JR
d5vLuyKDBcZNoS7nfXGRjqG07e7FD/ncbDdD4dfQt778IJCNRkgd3BIssX3dbzj7
lNsJDAVLir82SqWpE99ewmaTPDotT3hKLLDVv8XOwZqFhAP9D809tTWh9j7A5fL4
+BLJc5clAyN6pIhL32NlrENJWRZuEsf2jzhcHy43U8rxF0xE4WK4OmvYoVaI2B+w
ExAfYDdRRIk=
=XFYw
-----END PGP SIGNATURE-----