Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.2584
Advisory (icsa-19-192-04) Siemens SIMATIC RF6XXR
12 July 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Siemens SIMATIC RF6XXR
Publisher: ICS-CERT
Operating System: Windows
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2016-6329 CVE-2013-0169 CVE-2011-3389
Reference: ASB-2016.0098
ASB-2016.0054.2
ESB-2019.2561
ESB-2019.0097
Original Bulletin:
https://www.us-cert.gov/ics/advisories/icsa-19-192-04
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS Advisory (ICSA-19-192-04)
Siemens SIMATIC RF6XXR
Original release date: July 11, 2019
Legal Notice
All information products included in http://ics-cert.us-cert.gov are
provided"as is" for informational purposes only. The Department of Homeland
Security (DHS) does not provide any warranties of any kind regarding any
information contained within. DHS does not endorse any commercial product or
service, referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the header.
For more information about TLP, see http://www.us-cert.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 5.9
o ATTENTION : Exploitable remotely/public exploits are available
o Vendor : Siemens
o Equipment : SIMATIC RF6XXR
o Vulnerabilities : Improper Input Validation, Cryptographic Issues
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow access to
sensitive information.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the vulnerabilities affect all versions prior to 3.2.1 of
the following SIMATIC RF6XXR UHF RFID products:
o RF615R
o RF68XR
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER INPUT VALIDATION CWE-20
The SSL protocol encrypts data by using CBC mode with chained initialization
vectors, which may allow a man-in-the-middle attack to obtain plaintext HTTP
headers.
CVE-2011-3389 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( AV:N/AC:H/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
3.2.2 CRYPTOGRAPIC ISSUES CWE-310
Long-duration TLS sessions used with a 64-bit block cipher may allow remote
attackers to obtain cleartext data.
CVE-2016-6329 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( AV:N/AC:H/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
3.2.3 CRYPTOGRAPIC ISSUES CWE-310
Outdated versions of TLS and DTLS allow statistical analysis of timing data for
crafted packets, which may allow remote attackers to conduct distinguishing and
plaintext-recovery attacks.
CVE-2013-0169 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( AV:N/AC:H/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS : Critical Manufacturing, Food and
Agriculture, Transportation Systems
o COUNTRIES/AREAS DEPLOYED : Worldwide
o COMPANY HEADQUARTERS LOCATION : Germany
3.4 RESEARCHER
Wendy Parrington from United Utilities reported these vulnerabilities to
Siemens.
4. MITIGATIONS
Siemens recommends users upgrade to Version 3.2.1 or newer for both affected
products.
Siemens also recommends users restrict network access to the device.
For more information on these vulnerabilities and associated software updates,
please see Siemens' security advisory SSA-556833 at: https://www.siemens.com/
cert/advisories.
NCCIC recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:
o Minimize network exposure for all control system devices and/or systems,
and ensure that they are not accessible from the Internet .
o Locate control system networks and remote devices behind firewalls, and
isolate them from the business network.
o When remote access is required, use secure methods, such as Virtual Private
Networks (VPNs), recognizing that VPNs may have vulnerabilities and should
be updated to the most current version available. Also recognize that VPN
is only as secure as the connected devices.
NCCIC reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended
practices on the ICS webpage on us-cert.gov . Several recommended practices are
available for reading and download, including Improving Industrial Control
Systems Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber
Intrusion Detection and Mitigation Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to NCCIC for tracking
and correlation against other incidents.
High skill level is needed to exploit.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXSgafmaOgq3Tt24GAQg7BQ/7B/SUubDTxBa5WVUSsHhECsfsuDK/h2em
QadIUu5EEPhnlnkMklI5gZxELlB4dfn3G4BOdF4+aImZf2y4CnK1MHajqNV8bjOf
AkEPbM8I2ZCf3Tz1n889Lg34QNACeIeflJ+gYw/xCof/GYNU+0NEQjIUB1RCp3Q5
7cWonGQQjRQ39mA2eb54rJ0Qo1Eg4FWYYOTEITdVIx+4dSLO9f/lHwUL9uvuwaOV
Mjy351Yx91NGE4BCWMVMaNh5B8f2yKOnz4XBmb8rbM3WdRDbqhR6gMPhprg6a9WI
J61KuVVS1U7B79z/RstjBZi14qp6r0qA2lOOhqr8pT1SoBXUrpDIHQ1r0e0I04Yn
WHuyp4uaqE9trLp5k/XAvCE9LD1JhvoyGP1xgkkuvyk+Rf7NqpdLn3+WcqJkFV38
QRi2DORYiLdDpitWeHz9ItIlGY/diWZ1lPd6V6a1ptzRQEsA4umx7aYK+wOWN2zl
EvRkrn/zUsdjNunVYVku1qRa3ibS5dkd1HJ/rX11UBXzm/HmTBc+bhrr9VUyUnCV
QFEhSJbxI7W8LU2zN4kyBGZbSIGXY0xle2fxl1aZYV46owLLNwI7OYAh+6VVMt8Q
kdxCt3qWhBteZ7jOB6bftaCFwJaCFuHMR2Vv9lIp+kc+rSSVIcHrxghnlA2SGTZD
jWCKOtfebf8=
=IFs8
-----END PGP SIGNATURE-----