plc.myforum.ro :: Logix PLC Denial of Service/Buffer Overflow Vulnerability

plc.myforum.ro
PLCs users www.plc.myforum.ro!

FAQ

Memberlist

Usergroups

Profile

Logix PLC Denial of Service/Buffer Overflow Vulnerability

plc.myforum.ro Forum Index -> ALLEN-BRADLEY(Rockwell Automation) Reg. U

View previous topic :: View next topic

Author

Message

zumzi
Member 3

Joined: 01 Feb 2014
Posts: 501

Posted: 08/12/2016 19:39 Post subject: Logix PLC Denial of Service/Buffer Overflow Vulnerability

Logix PLC Denial of Service/Buffer Overflow Vulnerability

Version 1.0 - December 8, 2016

A Denial of Service ("DoS") by a Major Non-Recoverable Fault ("MNRF") vulnerability exists in numeroase Logix controllers.
Logix is a product line of Programmable Logic Controllers ("PLCs") used to control processes across several sectors,
including without limitation critical infrastructure; water/wastewater systems entertainment; food and beverage;
and automotive applications. Due to the breadth of platforms potentially affected,
Rockwell Automation has been conducting thorough evaluations to help achieve completeness in its risk assessment and mitigation processes.

An exploit of this vulnerability could induce a fault condition, and may also allow an attacker to execute code on a target controller through a buffer overflow.
As of this announcement and to the knowledge of Rockwell Automation, there is no publicly available exploit code relating to this vulnerability.

Customers using affected versions of this software are encouraged to evaluate the mitigations provided below,
and apply the applicable mitigations to their deployed products. Additional details relating to the discovered vulnerability,
including affected products and recommended countermeasures, are provided herein.
AFFECTED PRODUCTS

The affected firmware versions are listed, followed by a list of the products that utilize versions of the affected firmware.

Code:

FRN 16.00
ControlLogix® 5560 controllers (V16.020 thru V16.022)
ControlLogix L55 controllers (V16.020 thru V16.022)
ControlLogix 5560 Redundant (All Versions)
GuardLogix® 5560 controllers (All Versions)
FlexLogix™ L34 controllers (All Versions)
1769 CompactLogix™ L23x controllers (All Versions)
1769 CompactLogix L3x controllers (V16.020 thru V16.023)
1768 CompactLogix L4x controllers, (V16.020 thru V16.025)

FRN 17.00
SoftLogix™ 5800 controllers (All Versions)
ControlLogix® 5560 controllers (All Versions)
GuardLogix® 5560 controllers (All Versions)
1769 CompactLogix™ L23x controllers (All Versions)
1769 CompactLogix L3x controllers (All Versions)
1768 CompactLogix L4x controllers (All Versions)

FRN 18.00
SoftLogix™ 5800 controllers (All Versions)
RSLogix™ Emulate 5000 (All Versions)
ControlLogix® 5560 controllers (All Versions)
ControlLogix 5570 controllers (All Versions)
GuardLogix® 5560 controllers (All Versions)
1769 CompactLogix™ L23x controllers (All Versions)
1769 CompactLogix L3x controllers (All Versions)
1768 CompactLogix L4x controllers (All Versions)
1768 Compact GuardLogix® L4xS (All Versions)

FRN 19.00
SoftLogix™ 5800 controllers (All Versions)
RSLogix™ Emulate 5000 (All Versions)
ControlLogix® 5560 controllers (All Versions)
ControlLogix 5570 controllers (All Versions)
ControlLogix 5560 Redundant (All Versions)
GuardLogix® 5560 controllers (All Versions)
1769 CompactLogix™ L23x controllers (All Versions)
1769 CompactLogix L3x controllers (All Versions)
1768 CompactLogix L4x controllers (All Versions)
1768 Compact GuardLogix® L4xS controllers (All Versions)

FRN 20.00
SoftLogix™ 5800 controllers (All Versions)
RSLogix™ Emulate 5000 (All Versions)
ControlLogix® 5560 controllers (V20.010 thru V20.013)
ControlLogix 5570 controllers (V20.010 thru V20.013)
ControlLogix 5560 Redundant (V20.050 thru V20.055)
ControlLogix 5570 Redundant (V20.050 thru V20.055)
GuardLogix® 5560 controllers (V20.010 thru V20.017)
GuardLogix 5570 controllers (V20.010 thru V20.017)
1769 CompactLogix™ L23x controllers (V20.010 thru V20.013)
1769 CompactLogix L3x controllers (V20.010 thru V20.013)
1769 CompactLogix 5370 L1 controllers (V20.010 thru V20.013)
1769 CompactLogix 5370 L2 controllers (V20.010 thru V20.013)
1769 CompactLogix 5370 L3 controllers (V20.010 thru V20.013)
1768 CompactLogix L4x controllers (All Versions)
1768 Compact GuardLogix® L4xS controllers (All Versions)

FRN 21.00
SoftLogix™ 5800 controllers (All Versions)
RSLogix™ Emulate 5000 (All Versions)
ControlLogix® 5570 controllers (All Versions)
ControlLogix 5570 Redundant (All Versions)
GuardLogix® 5570 controllers (All Versions)
1769 CompactLogix™ 5370 L1 controllers (All Versions)
1769 CompactLogix 5370 L2 controllers (All Versions)
1769 CompactLogix 5370 L3 controllers (All Versions)

The products above are affected in the corresponding versions of firmware. If using a product above but with a version of firmware that is not listed,
check the Updates/Risk Mitigations section below to ensure that all functional versions of firmware include the latest security updates for this issue.
VULNERABILITY DETAILS
This vulnerability may allow an attacker to send a specific malformed packet to the product and cause a Major Non-Recoverable Fault ("MNRF")
resulting in a Denial of Service ("DoS") condition. This vulnerability also has the potential to exploit a buffer overflow condition,
which may allow the attacker to inject malicious code into the controller. This vulnerability is remotely exploitable.
The impact of such an attack would be highly dependent on the nature of the injected code, the design of the control system and other controls a user may have in place.

RISK MITIGATIONS
Customers using affected controllers are encouraged to upgrade to an available software version that addresses the associated risk and includes added improvements to further harden the software and enhance its resilience against similar malicious attacks.

Where feasible, additional precautions and risk mitigation strategies to this type of attack, like those listed below are similarly recommended. Employ multiple strategies when possible.

Update supported products based on this table:
Logix PLC Denial of Service/Buffer Overflow Vulnerability Logix PLC Denial of Service/Buffer Overflow Vulnerability

Logix PLC Denial of Service/Buffer Overflow Vulnerability Logix PLC Denial of Service/Buffer Overflow Vulnerability

Note: Customers using affected versions of FlexLogix, as a discontinued product are urged to atingere their local distributor or Sales Office in order to upgrade to newer product lines which have been remediated.
Use proper network infrastructure controls, such as firewalls, to help confirm that requests from unauthorized sources are blocked.
When possible, keep the controller in RUN mode rather than Remote RUN or Remote Program in order to prevent other disruptive changes to your system.
Minimize network exposure for all control system devices and/or systems, and help confirm that they are not accessible from the Internet.
Locate control system networks and devices behind firewalls, and isolate them from the business network.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.

Industrial Security Advisory Index

This Industrial Security Advisory Index is a publicly available resource and subscription service that points to specific Rockwell Automation product security alerts,
advisories and security recommendations. As new disclosures are added, subscribers to service will receive a proactive notification.
The links provided here are intended to raise customer awareness of risks to affected product operation or performance and also supply relevant recommendations
for how to micÈ™oreazÄƒ or removing such risks.

Identifying and addressing security risks and enhancing the protection of people, property and information are essential considerations
for all industrial control systems. Rockwell Automation recognizes the importance of cybersecurity for these systems and continually invests to deliver security-quality
and valued features with our products to help customers create a greater level of protection and resilience in the systems they design, install, operate and maintain.
While we strive to provide only the most secure products to industry, we recognize there always remains the potential that security vulnerabilities may still be found
in our products. For this reason, we complement our security design, testing and manufacturing processes with continuous improvement activities to address
and communicate risks we may learn about well after our products are put to use.

Rockwell Automation Security Notices & Alerts:

Code:

54103 - Firmware Upgrade Security Notice: Comment on DHS Communication (Control Systems Vulnerability)
57729 - Potential Security Vulnerabilities in ControlLogix 1756-ENBT/A EtherNet/IP Bridge
58964 - ControlLogix 1756-ENBT/A EtherNet/IP Bridge Firmware Upgrade Process
65980 - Password Security Vulnerability in MicroLogix™ Controllers
65982 - Client Software Authentication Security Vulnerability in MicroLogix™ Controllers
66678 - Password Security Vulnerability in PLC5® and SLC™ 5/0x Controllers
66684 - Client Software Authentication Security Vulnerability in PLC5® and SLC™ 5/0x Controllers
67272 - RSLinx Classic EDS Wizard Buffer Overflow Vulnerability - 3/3/2010
69735 - Open UDP Port in 1756-ENBT EtherNet/IP™ Communication Interface
748430 - Rockwell Automation recommended mitigations for Zero day vulnerability (W32.stuxnet)
278864 - Security vulnerability in password mechanism of MicroLogix™ 1100 and 1400 Controllers
279194 - RSLinx Classic EDS Wizard Buffer Overflow Vulnerability - 5/24/2010
433318 - ControlLogix 1756-EWEB Enhanced Web Server FTP Server Security Vulnerability
433319 - ControlLogix 1756-EN2T EtherNet/IP Bridge Firmware Upgrade Security Vulnerability
433320 - ControlLogix 1756-EWEB Enhanced Web Server Firmware Upgrade Security Vulnerability
448424 - Opening a corrupted FactoryTalk Diagnostics Viewer Config file (*.FT) could cause arbitrary code execution
448266 - RSLinx Classic OPC Automation ActiveX component vulnerability could allow arbitrary code execution
450807 - RSLogix 5000 .ACD Project File Memory Corruption Anomaly
456065 - RSLogix 5000 Software Potential Denial-of-Service Vulnerability (Replaced with TN 456144)
456144 - FactoryTalk RnaUtility.dll Vulnerability (Replaces TN 456065)
457430 - 1756-EN2TR and 1756-EN3TR Open UDP Port Vulnerability
469937 - FactoryTalk™ Diagnostics Receiver Service Vulnerability
470154 - EtherNet/IP Product Vulnerabilities
470155 - Rockwell Automation Logix™ Controller Vulnerabilities
470156 - MicroLogix™ 1100 and 1400 Controller Vulnerability
494865 - Advisory on web search tools that identify ICS devices and systems connected to the Internet
511407 - MicroLogix, SLC 500 and PLC5 Controller Vulnerability
514189 - FactoryTalk® Historian SE Security Vulnerability from PI OPC DA software interface
516483 - Vulnerability claims relating to FactoryTalk Services and RSLogix 5000 Software
535953 - Stratix 5700, 8000 and 8300 Weak Password Vulnerability
537599 - FactoryTalk Diagnostics and RSLinx Enterprise Software Vulnerability
571542 - FactoryTalk Activation Manager Unnecessary Third-party Service
582544 - RSLogix™ 5000 Password Vulnerability
620295 - MicroLogix 1400 DNP3 Vulnerability
626689 - Connected Components Workbench (CCW) ActiveX Component Vulnerability
646323 - FactoryTalk Services Platform and FactoryTalk View Studio DLL Hijacking Vulnerability
646324 - RSLinx Classic File Input Buffer Overflow in OpcTest.exe
700915 - RSView32 Weak Encryption Algorithm on Passwords
731098 - CompactLogix Reflective Cross-site Scripting (XSS) Vulnerability (UPDATED 01-MAR-2016)
731427 - MicroLogix Web Redirect Vulnerability
731757 - FT Historian SE OSIsoft PI Data Archive Vulnerabilities
732399 - MicroLogix 1100 and 1400 Controller Vulnerabilities (UPDATED 08-DEC-2015)
758239 - SCADAPass Default Passwords (UPDATED 12-JAN-2016)
765050 - MicroLogix 1100 Web Server Buffer Overflow (UPDATED 26-JAN-2016)
771467 - Integrated Architecture Builder (IAB) Access Violation (UPDATED 24-FEB-2016)
799091 - Claims of ransomware masquerading as an Allen-Bradley Update (UPDATED 08-JUL-2016)
864519 - PowerFlex 7000 Writeable Parameters (UPDATED 07-JUN-2016)
866393 - FactoryTalk® EnergyMetrix™ Authentication Vulnerabilities (UPDATED 21-JUN-2016)
866255 - Stratix® 5400 and Stratix 5410 ICMP IPv4 Packet Corruption Vulnerability (UPDATED 23-JUN-2016)
898352 - MicroLogix™ 1400 SNMP Credentials (UPDATED 11-AUG-2016)
898582 - RSLogix 500® and RSLogix™ Micro File Parser Buffer Overflow (UPDATED 11-AUG-2016)
942592 - Stratix® Denial of Service Vulnerabilities (UPDATED 10-OCT-2016)
968962 - MicroLogix Controller Vulnerabilities (UPDATED 01-DEC-2016)
970074 - Logix PLC Denial of Service/Buffer Overflow Vulnerability (UPDATED 08-DEC-2016)

Display posts from previous:

	plc.myforum.ro Forum Index -> ALLEN-BRADLEY(Rockwell Automation) Reg. U	All times are GMT + 2 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum