ID

VAR-201611-0018

CVE

CVE-2016-8672

TITLE

SIMATIC S7-300/S7-400 CPU family Information Disclosure Vulnerability

DESCRIPTION

A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission. plural Siemens SIMATIC Product integration Web The server https Session unspecified Cookie Against secure Because the flag is not set, Cookie There is a vulnerability that will be captured.By a remote attacker, http By intercepting transmissions within a session, Cookie May be captured. SiemensSIMATICS7-300/S7-400CPUfamilies are used to provide discrete and continuous control in industrial environments such as manufacturing, food and beverage, and the global chemical industry. An information disclosure vulnerability exists in the SIMATICS7-300/S7-400CPUfamily. Attackers exploit vulnerabilities to obtain sensitive information. Multiple Siemens Products are prone to a cross-site request-forgery vulnerability and an information-disclosure vulnerability. Other attacks are also possible. Siemens SIMATIC CP 343-1 Advanced and so on are the Ethernet communication modules used by German Siemens to support PROFINET (a new generation of automation bus standard based on industrial Ethernet technology). This vulnerability stems from configuration errors in network systems or products during operation. The following vulnerabilities have been reported to Siemens CERT and are now covered by by Siemens Security Advisory SSA-603476, published today (2016-11-21) and available at the following URL: http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-603476.pdf -- CVE-016-8672 --------------------------------------------------------- Summary: Lack of cookie protection for management web interface. The HttpOnly flag prevents client side scripts from accessing a cookie, mitigating cross-site scripting (XSS) attacks. The session cookie weaknesses, with particular reference to the lack of the Secure flag, highlight the need for a forced encrypted connection to the exposed web interface, in order to mitigate any hijacking of its credentials Credit: Inverse Path auditors in collaboration with AIRBUS ICT Industrial Security team -- CVE-016-8673 --------------------------------------------------------- Summary: Cross-site request forgery for management web interface. Affected products: SIMATIC CP 343-1 Advanced: All versions < V3.0.53 SIMATIC CP 443-1 Advanced: All versions SIMATIC S7-300 CPU family: All firmware versions SIMATIC S7-400 CPU family: All firmware versions Description: The Cross-site request forgery (CSRF) class of attacks leverages on the trust that a logged in user gives to HTML content of unrelated origins, by triggering unauthorized commands via HTML links or scripts injected by the attacker in the browser context. The web management interface does not take advantage of any CSRF protection mechanism. This omission allows unauthorized POST requests to be issued by any JavaScript loaded in the user browser execution context, regardless of their origin. Given the fact that the affected products support POST requests, to upload Access Control List (ACL) configuration or customer specific actions, the lack of CSRF protection exposes the risk of unauthenticated management actions. Credit: Inverse Path auditors in collaboration with AIRBUS ICT Industrial Security team ------------------------------------------------------------------------- -- Andrea Barisani Inverse Path Srl Chief Security Engineer -----> <-------- <andrea@inversepath.com> http://www.inversepath.com 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

information disclosure

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

The vendor reported this issue.

SOURCES

LAST UPDATE DATE

2024-08-14T14:20:43.061000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE