Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.1180
A vulnerability has been identified in Siemens devices using
the PROFINET Discovery and Configuration Protocol
10 May 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Siemens SIMATIC products
Siemens SCALANCE products
Siemens SIRIUS products
Siemens SINAMICS products
Siemens SINUMERIK products
Siemens SIMOTION
Siemens STEP 7 - Micro/WIN SMART
Siemens SMART PC Access
Siemens Primary Setup Tool (PST)
Siemens Security Configuration Tool (SCT)
Siemens SINEMA Server
Siemens SINAUT ST7CC
Siemens SITOP
Publisher: ICS-CERT
Operating System: Network Appliance
Windows
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-6865 CVE-2017-2681 CVE-2017-2680
Original Bulletin:
https://ics-cert.us-cert.gov/advisories/ICSA-17-129-01
https://ics-cert.us-cert.gov/advisories/ICSA-17-129-02
Comment: This bulletin contains two (2) ICS-CERT security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
Advisory (ICSA-17-129-01)
Siemens devices using the PROFINET Discovery and Configuration Protocol
Original release date: May 09, 2017
Legal Notice
All information products included in http://ics-cert.us-cert.gov are provided
"as is" for informational purposes only. The Department of Homeland Security
(DHS) does not provide any warranties of any kind regarding any information
contained within. DHS does not endorse any commercial product or service,
referenced in this product or otherwise. Further dissemination of this product
is governed by the Traffic Light Protocol (TLP) marking in the header. For
more information about TLP, see http://www.us-cert.gov/tlp/.
CVSS v3 6.5
ATTENTION: Exploitable from an adjacent network/low skill level to exploit.
Vendor: Siemens
Equipment: Devices using the PROFINET Discovery and Configuration Protocol
(DCP)
Vulnerability: Denial of Service
AFFECTED PRODUCTS
Siemens reports that the vulnerability affects the following products using
the PROFINET DCP:
SIMATIC WinCC (TIA Portal)
V13: All versions prior to V13 SP2, and
V14: All versions prior to V14 SP1
SIMATIC STEP 7 (TIA Portal)
V13: All versions prior to V13 SP2, and
V14: All versions prior to V14 SP1
SIMATIC STEP 7 V5.X: All versions,
STEP 7 - Micro/WIN SMART: All versions,
SMART PC Access V2.0,
SIMATIC Automation Tool: All versions,
SIMATIC WinCC: All versions,
SIMATIC PCS 7: All versions,
SIMATIC NET PC-Software: All versions,
Primary Setup Tool (PST): All versions,
Security Configuration Tool (SCT): All versions,
SINEMA Server: All versions,
SINAUT ST7CC: All versions,
SIMATIC WinAC RTX 2010 SP2: All versions,
SIMATIC WinAC RTX F 2010 SP2: All versions,
SINUMERIK 808D Programming Tool: All versions, and
SIMATIC WinCC flexible 2008: All versions.
IMPACT
An attacker may be able to cause a denial-of-service condition requiring a
manual restart by exploiting this vulnerability.
MITIGATION
Siemens provides updates that fix the vulnerability for the following affected
products and recommends users update to the new fixed version:
SIMATIC WinCC (TIA Portal) V13: Update to V13 SP2
https://support.industry.siemens.com/cs/ww/en/view/109746073 (link is
external)
SIMATIC WinCC (TIA Portal) V14: Update to V14 SP1
https://support.industry.siemens.com/cs/ww/en/view/109745460 (link is
external)
SIMATIC STEP 7 (TIA Portal) V13: Update to V13 SP2
https://support.industry.siemens.com/cs/ww/en/view/109745155 (link is
external)
SIMATIC STEP 7 (TIA Portal) V14: Update to V14 SP1
https://support.industry.siemens.com/cs/ww/en/view/109745984 (link is
external)
The affected component is shared among all of the affected products on the
host. Installing one fixed version will mitigate the vulnerability for all
Siemens applications installed on that host.
Siemens is preparing updates for the remaining affected products and
recommends the following mitigations in the meantime:
Apply cell protection concept
https://support.industry.siemens.com/cs/ww/en/view/60119725 (link is external)
Use VPN for protecting network communication between cells
Apply Defense-in-Depth
As a general security measure, Siemens strongly recommends protecting
industrial control systems networks with appropriate mechanisms. Siemens
advises configuring the environment according to Siemens operational
guidelines in order to run the devices in a protected IT environment.
https://www.siemens.com/cert/operational-guidelines-industrial-security (link
is external)
For more information on this vulnerability and more detailed mitigation
instructions, please see Siemens Security Advisory SSA-275839 at the following
location:
http://www.siemens.com/cert/en/cert-security-advisories.htm (link is external)
ICS-CERT reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
ICS-CERT also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are
available for reading and download, including Improving Industrial Control
Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly
available in the ICS-CERT Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies, that is available for download from the ICS-CERT web site.
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to ICS-CERT for
tracking and correlation against other incidents.
No known public exploits specifically target this vulnerability.
VULNERABILITY OVERVIEW
IMPROPER INPUT VALIDATION CWE-20
Specially crafted PROFINET DCP broadcast packets sent to the affected products
on a local Ethernet segment (Layer 2) could cause a denial-of-service
condition in some services. The services may require manual restart to
recover.
CVE-2017-6865 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is
(AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
RESEARCHER
Duan JinTong, Ma ShaoShuai, and Cheng Lei from NSFOCUS Security Team reported
this vulnerability directly to Siemens.
BACKGROUND
Critical Infrastructure Sectors: Critical Manufacturing, Food and Agriculture,
Chemical, Energy, Water and Wastewater Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Contact Information
For any questions related to this report, please contact ICS-CERT at:
Email: ics-cert@hq.dhs.gov (link sends e-mail)
Toll Free: 1-877-776-7585
International Callers: (208) 526-0900
For industrial control systems security information and incident reporting:
http://ics-cert.us-cert.gov
ICS-CERT continuously strives to improve its products and services. You can
help by choosing one of the links below to provide feedback about this
product.
- ---
Advisory (ICSA-17-129-02)
Siemens devices using the PROFINET Discovery and Configuration Protocol
Original release date: May 09, 2017
Legal Notice
All information products included in http://ics-cert.us-cert.gov are provided
"as is" for informational purposes only. The Department of Homeland Security
(DHS) does not provide any warranties of any kind regarding any information
contained within. DHS does not endorse any commercial product or service,
referenced in this product or otherwise. Further dissemination of this product
is governed by the Traffic Light Protocol (TLP) marking in the header. For
more information about TLP, see http://www.us-cert.gov/tlp/.
CVSS v3 6.5
ATTENTION: Exploitable from an adjacent network/low skill level to exploit.
Vendor: Siemens
Equipment: Devices using the PROFINET Discovery and Configuration Protocol
(DCP)
Vulnerability: Denial of Service
AFFECTED PRODUCTS
Siemens reports that these vulnerabilities affect the following products using
PROFINET DCP:
SIMATIC CP 343-1 Std, CP 343-1 Lean: All versions,
SIMATIC CP 343-1 Adv: All versions,
SIMATIC CP 443-1 Std, CP 443-1 Adv: All versions prior to V3.2.17,
SIMATIC CP 443-1 OPC-UA: All versions,
SIMATIC CP 1243-1: All versions,
SIMATIC CM 1542-1: All versions prior to V2.0,
SIMATIC CP 1543SP-1, CP 1542SP-1 and CP 1542SP-1 IRC: All versions,
SIMATIC CP 1543-1: All versions prior to V2.1,
SIMATIC RF650R, RF680R, RF685R: All versions prior to V3.0,
SIMATIC CP 1616, CP 1604, DK-16xx PN IO: All versions prior to V2.7,
SCALANCE X200: All versions,
SCALANCE X200 IRT: All versions,
SCALANCE X300, X408, X414: All versions,
SCALANCE XM400, XR500: All versions,
SCALANCE W700: All versions prior to V6.1,
SCALANCE M-800,S615: All versions,
Softnet PROFINET IO for PC-based Windows systems: All versions,
IE/PB-Link: All versions prior to V3.0,
IE/AS-i Link PN IO: All versions,
SIMATIC Teleservice Adapter Standard Modem, IE Basic, IE Advanced: All
versions,
SITOP PSU8600 / UPS1600 PROFINET: All versions,
SIMATIC ET 200 Interface modules for PROFINET IO:
SIMATIC ET 200AL: All versions,
SIMATIC ET 200ecoPN: All versions,
SIMATIC ET 200M: All versions,
SIMATIC ET 200MP: All versions prior to V4.0.1,
SIMATIC ET 200pro: All versions,
SIMATIC ET 200S: All versions,
SIMATIC ET 200SP: All versions,
PN/PN Coupler: All versions,
Development/Evaluation Kits for PROFINET IO:
DK Standard Ethernet Controller: All versions prior to V4.1.1 Patch04,
EK-ERTEC 200P PN IO: All versions prior to V4.4.0 Patch01,
EK-ERTEC 200 PN IO: All versions prior to V4.2.1 Patch03,
SIMATIC S7-200 SMART: All versions,
SIMATIC S7-300 including F and T: All versions prior to V3.X.14,
SIMATIC S7-400 including F and H: All versions,
SIMATIC S7-1200 including F: All versions prior to V4.2.1,
SIMATIC S7-1500 including F, T, and TF: All versions prior to V2.1,
SIMATIC S7-1500 Software Controller including F: All versions prior to V2.1,
SIMATIC WinAC RTX 2010 including F: All versions,
SIRIUS ACT 3SU1 interface module PROFINET: All versions,
SIRIUS Soft starter 3RW44 PN: All versions,
SIRIUS Motor starter M200D PROFINET: All versions,
SIMOCODE pro V PROFINET : All versions,
SINAMICS:
SINAMICS DCM: All versions,
SINAMICS DCP: All versions,
SINAMICS G110M / G120(C/P/D) w. PN: All versions prior to V4.7 SP6 HF3,
SINAMICS G130 and G150: All versions prior to V4.8 HF4,
SINAMICS S110 w. PN: All versions,
SINAMICS S120: All versions prior to V4.8 HF4,
SINAMICS S150: All versions prior to V4.8 HF4,
SINAMICS V90 w. PN: All versions,
SIMOTION: All versions prior to V4.5 HF1,
SINUMERIK 828D:
V4.5 and prior: All versions,
V4.7: All versions prior to V4.7 SP4 HF1,
SINUMERIK 840D sl:
V4.5 and prior: All versions prior to V4.5 SP6 HF8,
V4.7: All versions prior to V4.7 SP4 HF1, and
SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels: All versions.
IMPACT
Successful exploitation of these vulnerabilities could cause the targeted
device to enter a denial-of-service condition, which may require human
interaction to recover the system.
MITIGATION
The attacker must have network access to the local Ethernet segment (Layer 2).
Siemens strongly recommends verifying that the affected products are protected
as described in PROFINET Security Guidelines and Siemens Operational
Guidelines in order to run the devices in a protected IT environment.
http://www.profibus.com/download/downloads/profinet-security-guideline/display/
(link is external)
https://www.siemens.com/cert/operational-guidelines-industrial-security (link
is external)
Siemens provides firmware updates fixing the vulnerabilities for the following
affected products and recommends users update to the new fixed version:
SIMATIC CP 443-1 Std: Update to V3.2.17
https://support.industry.siemens.com/cs/ww/en/view/109745387 (link is
external)
SIMATIC CP 443-1 Adv: Update to V3.2.17
https://support.industry.siemens.com/cs/ww/en/view/109745388 (link is
external)
SIMATIC CM1542-1: Update to V2.0
https://support.industry.siemens.com/cs/ww/en/view/109744924 (link is
external)
SIMATIC CP 1543-1: Update to V2.1
https://support.industry.siemens.com/cs/ww/en/view/109747253 (link is
external)
SIMATIC RF650R, RF680R, RF685R: Update to V3.0
https://support.industry.siemens.com/cs/ww/en/view/109743740 (link is
external)
SIMATIC CP 1616, CP 1604, DK-16xx PN IO: Update to V2.7
https://support.industry.siemens.com/cs/ww/en/view/109743058 (link is
external)
SCALANCE W700: Update to V6.1.0
https://support.industry.siemens.com/cs/ww/en/view/109744953 (link is
external)
IE/PB-Link: Upgrade to V3.0
https://support.industry.siemens.com/cs/ww/en/view/109744504 (link is
external)
Development/Evaluation Kits for PROFINET IO:
DK Standard Ethernet Controller: All versions prior to V4.1.1 Patch04
EK-ERTEC 200P PN IO: All versions prior to V4.4.0 Patch01
EK-ERTEC 200 PN IO: All versions prior to V4.2.1 Patch03
Updates for Development/Evaluation Kits for PROFINET IO can be obtained via
ComDeC at comdec@siemens.com (link sends e-mail) or pic.industry@siemens.com
(link sends e-mail)
SIMATIC S7-300 including F and T: Update to V3.X.14
https://support.industry.siemens.com/cs/ww/de/ps/13752/dl (link is external)
or
https://support.industry.siemens.com/cs/ww/en/ps/13752/dl (link is external)
SIMATIC S7-1200 including F: Update to V4.2
https://support.industry.siemens.com/cs/ww/en/view/109741461 (link is
external)
SIMATIC S7-1500 including F, T and TF: Update to V2.1
https://support.industry.siemens.com/cs/ww/en/view/109478459 (link is
external)
SIMATIC S7-1500 Software Controller including F: Update to V2.1
https://support.industry.siemens.com/cs/ww/en/view/109478528 (link is
external)
SINAMICS:
SINAMICS G110M/G120(C/P/D) w. PN: Update to V4.7 SP6 HF3
https://support.industry.siemens.com/cs/ww/en/view/109482659 (link is
external)
SINAMICS G130 and G150: V4.8: Update to V4.8 HF4
https://support.industry.siemens.com/cs/ww/en/view/109742040 (link is
external)
SINAMICS S120: V4.8: Update to V4.8 HF4
https://support.industry.siemens.com/cs/de/en/view/109740193 (link is
external)
SINAMICS S150: V4.8: Update to V4.8 HF4
https://support.industry.siemens.com/cs/ww/en/view/109742040 (link is
external)
SIMOTION: Update to V4.5 HF1
https://support.industry.siemens.com/cs/ww/en/view/109742328 (link is
external)
SINUMERIK 828D: V4.7: All versions prior to V4.7 SP4 HF1
SINUMERIK software can be obtained from the local Siemens account manager
SINUMERIK 840D sl:
V4.5 and prior: Update to V4.5 SP6 HF8
V4.7: Update to V4.7 SP4 HF1
SINUMERIK software can be obtained from the local Siemens account manager
Siemens is preparing updates for the remaining affected products and
recommends the following mitigations in the meantime:
Apply cell protection concept
Use VPN for protecting network communication between cells
Apply Defense-in-Depth
As a general security measure Siemens and PNO strongly recommend protecting
industrial control systems networks with appropriate mechanisms. Siemens
encourages users to verify that the affected products are protected as
described in PNO Security Guidelines and Siemens operational guidelines in
order to run the devices in a protected IT environment.
https://www.siemens.com/cert/operational-guidelines-industrial-security (link
is external)
For more information on these vulnerabilities and more detailed mitigation
instructions, please see Siemens Security Advisory SSA-293562 at the following
location:
http://www.siemens.com/cert/en/cert-security-advisories.htm (link is external)
ICS-CERT reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
ICS-CERT also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are
available for reading and download, including Improving Industrial Control
Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly
available in the ICS-CERT Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies, that is available for download from the ICS-CERT web site.
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to ICS-CERT for
tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
VULNERABILITY OVERVIEW
IMPROPER INPUT VALIDATION CWE-20
Specially crafted PROFINET DCP broadcast packets could cause a
denial-of-service condition of affected products on a local Ethernet segment
(Layer 2). Human interaction is required to recover the systems. PROFIBUS
interfaces are not affected.
CVE-2017-2680 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is
(AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
IMPROPER INPUT VALIDATION CWE-20
Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer
2) to an affected product could cause a denial-of-service condition in that
product. Human interaction is required to recover the system. PROFIBUS
interfaces are not affected.
This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile
Panels, and S7-300/S7-400 devices.
CVE-2017-2681 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is
(AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
RESEARCHER
Duan JinTong, Ma ShaoShuai, and Cheng Lei from NSFOCUS Security Team reported
these vulnerabilities directly to Siemens.
BACKGROUND
Critical Infrastructure Sectors: Critical Manufacturing, Food and Agriculture,
Chemical, Energy, Water and Wastewater Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Contact Information
For any questions related to this report, please contact ICS-CERT at:
Email: ics-cert@hq.dhs.gov (link sends e-mail)
Toll Free: 1-877-776-7585
International Callers: (208) 526-0900
For industrial control systems security information and incident reporting:
http://ics-cert.us-cert.gov
ICS-CERT continuously strives to improve its products and services. You can
help by choosing one of the links below to provide feedback about this
product.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWRKulox+lLeg9Ub1AQgfNRAArGw+cQRYaanmDWlp7BR0C00SzgLwT92f
9QLzE8FX3fjK383aA1/JhJ8CYQXC4Ju9SoQER+4YUYdNRltfUiYiQPMjCi4U300H
k7tRTdUS82VcazepxZXsQxmOLDGHmTmJiuTjwEt0bub9scKFxpfRlfcawLiVIOqi
qC+pQeYjaSCh2yu3oC9Mco93O18Lh/gd/79QpPoWwPfmXyDItcG+sD77QRVnKeZm
UgFw3yvZSWgWHtgXPxcsGELhZsLcoggyIn3fFLVxm+4bf47QSKY3UUizQRvgXscL
pgFP8QkP7MXiiVo6k1BIG55Uv+vlznrRPbDsfzmS3dlA1rK0VMhjBw6Apy739y3x
DgrIf7CYhl0ZOYbYhJCZVpuksqt4mLygnI/kuMtWuj23iBSWzRVIYi8VNJFZUTh3
r6Ss10z0zI0rtxfEDew0YQK/9X/O1ws9rsYSLl6SVTtaD4hPrRPzl01c95jk4cs+
iYFlYuISPCuvti7koL5ESdQqjyTAAWOr1HTVkJicLygR7+QRINCHIgpdvE5hBP5a
lVHCGT3DBVMbOhFGAHbxhjws1Y/49RH7t3161xDPOc4JrS83YdtfwcmifyG6zxEs
PPG++NAhYXRFo8dE3Pq3YAsZuq5e7F/iHJ6YVzTcbgeuCss6BQ+APWzPMOTWw7m1
XmyjtdETG5I=
=wzg4
-----END PGP SIGNATURE-----