There is an update available for the multiple vulnerabilities in the Siemens WinCC 7.0 SP3 web server and web applications.
The vulnerabilities came to light when independent researchers Gleb Gritsai, Alexander Zaitsev, Sergey Scherbel, Yuri Goltsev, Dmitry Serebryannikov, Sergey Bobrov, Denis Baranov, Andrey Medov from Positive Technologies identified the holes, according to a report from ICS-CERT. In the process of analyzing the issues, Siemens found an additional vulnerability.
Siemens created an update that resolves all these remotely exploitable vulnerabilities except the buffer overflow in DiagAgent, which no longer receives support so users can mitigate the issue by disabling the service.
These vulnerabilities may allow an attacker to gain unauthorized access, read from, or write to files and settings on the target system.
Siemens SIMATIC HMI is a software package used as an interface between the operator and the programmable logic controllers (PLCs) controlling the process. SIMATIC HMI performs the following tasks: Process visualization, operator control of the process, alarm display, process value and alarm archiving, and machine parameter management. This software sees use across industries such as food and beverage, water and wastewater, oil and gas, and chemical.
WinCC web applications are susceptible to reflected cross-site scripting because they do not filter out characters when parsing URL parameters. Exploitation of this vulnerability may give an attacker authenticated access to WinCC web applications. CVE-2012-2595 is the number assigned to this vulnerability, which has a CVSS v2 base score of 4.3.
Web applications do not filter out special characters when parsing URL parameters. An attacker may exploit this vulnerability to read or write settings on the system. CVE-2012-2596 is the number assigned to this vulnerability, which has a CVSS v2 base score of 5.5.
Web applications do not sanitize URL parameters. That means an authenticated attacker can read arbitrary files on the system. CVE-2012-2597 is the number assigned to this vulnerability, which has a CVSS V2 base score of 6.8.
The DiagAgent Web server is for remote diagnostic purposes and disabled by default. If enabled, the service does not sanitize user input correctly. Specially crafted input can crash the DiagAgent, disabling the remote diagnostic service. CVE-2012-2598 is the number assigned to this vulnerability, which has a CVSS V2 base score of 4.3.
A Web application accepts a parameter in a HTTP GET request and interprets it as a URL. The victim’s browser then can redirect to that URL. If a victim clicks on a link prepared by an attacker, the victim’s browser could go to a malicious Web site instead of the WinCC system. CVE-2012-3003 is the number assigned to this vulnerability, which has a CVSS V2 base score of 3.4.
While there are no known exploits specifically target these vulnerabilities, an attacker with a low skill would be able to take advantage of these vulnerabilities.
Siemens released a security advisory and produced an update that resolves all vulnerabilities except the buffer overflow in DiagAgent. The update is available in Update 2 for WinCC V7.0 SP3. Siemens recommends applying this patch as soon as possible.