Vendor: Siemens
Equipment: SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products
Vulnerabilities: Security Features
This updated advisory is a follow-up to the updated advisory titled ICSA-17-318-01A Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products that was published December 5, 2017, on the NCCIC/ICS-CERT web site.
--------- Begin Update B Part 1 of 2 --------
Siemens reports that the key reinstallation attacks (KRACK) potentially affect the following Siemens industrial products:
--------- End Update B Part 1 of 2 ----------
Successful exploitation of these vulnerabilities could potentially allow an attacker within the radio range of the wireless network to decrypt, replay, or inject forged network packets into the wireless communication.
--------- Begin Update B Part 2 of 2 --------
Siemens has provided the following updates to address the vulnerabilities in the affected products:
<https://support.industry.siemens.com/cs/ww/en/view/109752596>
Contact the RUGGEDCOM support team at: <https://support.industry.siemens.com/my/WW/en/requests#createRequest>
<https://support.industry.siemens.com/cs/ww/en/view/109752556>
--------- End Update B Part 2 of 2 ----------
SCALANCE W1750D devices are not vulnerable in the default configuration. Only users who enable the “Mesh” or “WiFi uplink” functionality are affected by the vulnerabilities. Disabling these functionalities will completely mitigate the vulnerabilities.
SCALANCE WLC711 and WLC712 can deactivate IEEE 802.11r, “MeshConnect,” and “Client Bridge Mode” to reduce the risk, provided these modes have been activated and are not required for the operation of the wireless environment. All three functions are turned off by default.
SCALANCE W-700 standalone Access Points, RUGGEDCOM RX1400 and RS9xxW, are not vulnerable if operated in Access Point mode.
SCALANCE W-700 standalone devices, SIMATIC Mobile Panel 277F IWLAN, and SIMATIC ET200 WLAN, are not affected if the iPCF, iPCF-MC, or iPCF-HT features are enabled.
For the remaining affected products or if the mitigations outlined previously cannot be implemented, Siemens recommends the following mitigations in the meantime:
<https://www.siemens.com/cert/operational-guidelines-industrial-security>
For more information on this vulnerability and more detailed mitigation instructions, please see Siemens Security Advisory SSA-901333 at the following location:
<http://www.siemens.com/cert/en/cert-security-advisories.htm>
ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the ICS‑CERT Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
These vulnerabilities have been publicly disclosed. These vulnerabilities are exploitable from an adjacent network. High skill level is needed to exploit.
Wi-Fi protected access (WPA and WPA2) allows reinstallation of the pairwise key in the four-way handshake.
CVE-2017-13077 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Wi-Fi protected access (WPA and WPA2) allows reinstallation of the group temporal key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.
CVE-2017-13078 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the integrity group temporal key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.
CVE-2017-13079 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
Wi-Fi protected access (WPA and WPA2) allows reinstallation of the group temporal key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
CVE-2017-13080 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the integrity group temporal key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
CVE-2017-13081 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the pairwise transient key (PTK) temporal key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
CVE-2017-13082 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Wi-Fi protected access (WPA and WPA2) allows reinstallation of the station-to-station-link (STSL) transient key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
CVE-2017-13084 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Wi-Fi protected access (WPA and WPA2) allows reinstallation of the tunneled direct-link setup (TDLS) peer key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
CVE-2017-13086 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Wi-Fi protected access (WPA and WPA2) that support 802.11v allows reinstallation of the group temporal key (GTK) when processing a wireless network management (WNM) sleep mode response frame, allowing an attacker within radio range to replay frames from access points to clients.
CVE-2017-13087 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Wi-Fi protected access (WPA and WPA2) that support 802.11v allows reinstallation of the integrity group temporal key (IGTK) when processing a wireless network management (WNM) sleep mode response frame, allowing an attacker within radio range to replay frames from access points to clients.
CVE-2017-13088 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Mathy Vanhoef, of the Katholieke Universiteit Leuven in Belgium, discovered these vulnerabilities.
Critical Infrastructure Sectors: Chemical, Energy, Food and Agriculture, Healthcare and Public Health, Transportation Systems, and Water and Wastewater Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
ics-cert.us-cert.gov
ics-cert.us-cert.gov
twitter.com/icscert
twitter.com/icscert
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13077
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13078
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13079
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13080
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13081
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13082
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13084
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13086
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13087
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13088
www.addthis.com/bookmark.php?url=https%3A%2F%2Fics-cert.us-cert.gov%2Fadvisories%2FICSA-17-318-01B
www.dhs.gov
www.dhs.gov/report-cyber-risks
www.siemens.com/cert/en/cert-security-advisories.htm
www.us-cert.gov/accessibility/
www.us-cert.gov/pdf/
www.us-cert.gov/privacy/
www.us-cert.gov/tlp/
www.us-cert.gov/tlp/
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
cwe.mitre.org/data/definitions/254.html
ics-cert.us-cert.gov/
ics-cert.us-cert.gov/content/recommended-practices
ics-cert.us-cert.gov/Report-Incident?
ics-cert.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
ics-cert.us-cert.gov/tips/ICS-TIP-12-146-01B
support.industry.siemens.com/cs/ww/en/view/109752556
support.industry.siemens.com/cs/ww/en/view/109752596
support.industry.siemens.com/my/WW/en/requests#createRequest
twitter.com/share?url=https%3A%2F%2Fics-cert.us-cert.gov%2Fadvisories%2FICSA-17-318-01B
www.facebook.com/sharer.php?u=https%3A%2F%2Fics-cert.us-cert.gov%2Fadvisories%2FICSA-17-318-01B
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
www.siemens.com/cert/operational-guidelines-industrial-security
www.us-cert.gov/forms/feedback?helpful=no&document=ICSA-17-318-01B Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update B)&trackingNumber=&url=https://ics-cert.us-cert.gov/advisories/ICSA-17-318-01B&site_name=ICS-CERT
www.us-cert.gov/forms/feedback?helpful=somewhat&document=ICSA-17-318-01B Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update B)&trackingNumber=&url=https://ics-cert.us-cert.gov/advisories/ICSA-17-318-01B&site_name=ICS-CERT
www.us-cert.gov/forms/feedback?helpful=yes&document=ICSA-17-318-01B Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update B)&trackingNumber=&url=https://ics-cert.us-cert.gov/advisories/ICSA-17-318-01B&site_name=ICS-CERT