Security Alerts

Sprecher Automation informs about detailing several severe and also critical security vulnerabilities in different versions of the Wibu Systems CodeMeter User Runtime software.

The CodeMeter User Runtime Software is used by SPRECON-V460 for its software license protection.
The issues were addressed by Wibu Systems and a new version 7.10 was made available by Wibu Systems, in which these issues were resolved.

The CodeMeter User Runtime software is used for dongle and soft licensing by the SPRECON-V460 Editor, SPRECON-V460 Runtime, SPRECON-V460 Analyzer, SPRECON-V460 Web Server, SPRECON-V460 Logic/Straton Runtime and the Logic/Straton Workbench. This software is part of the installation of these software products, even when no dongle license is used.

SPRECON-V460 versions 8.00 and higher exclusively use the CodeMeter User Runtime software from Wibu Systems and are affected by these vulnerabilities.
SPRECON-V460 versions 8.00 and lower may use the CodeMeter User Runtime software from Wibu Systems and might be affected by these vulnerabilities.
The SPRECON-V460 Analyzer exclusively uses the CodeMeter User Runtime software from Wibu Systems and is affected by these issues.

Wibu Systems provides an updated version 7.10 of the CodeMeter User Runtime software, which addresses the reported vulnerabilities.

The “CodeMeter User Runtime for Windows” software can be downloaded via this link:
https://www.wibu.com/support/user/user-software.html
 

For more details, see our vulnerability announcement for SPRECON-V460.

Sprecher Automation wants to support our customer in properly estimating the risk that is concerned with engineering data, which shall always be stored in a secure way taking into account proper measures for logical access control.
 

The configuration of SPRECON-E devices is file-based; i.e. SPRECON-E engineering tools are used to create parameter files that are usually stored at MS Windows based engineering machines. A device engineer that properly authenticates at the devices and has write-permission can configure devices by downloading these parameter files via proprietary SPRECON-E engineering tools.

An attacker that gains access to these files at rest (i.e. the office machines that are used for engineering) might change the content of the files by adding malicious commands without the device engineers taking notice. In case the device engineers download the manipulated files, the attacker was successful in bringing malicious commands to the device.
 

Limitation: A user with access to proprietary SPRECON-E engineering tools needs to compile the finally downloadable parameter files (“PDL”) which adds proper checksums to the files so that these get accepted by the devices. In the end, a user has to authenticate at the targeted devices and have proper permissions in order to successfully bring the files to the target.

• SPRECON-E engineering data as well as device parameter files need to be stored with proper access restrictions in place in order to prevent unauthorized personal from access
• Before creating PDLs and downloading them to the devices, the configuration data should be checked for any unwanted content
• Engineering workstations as well as SPRECON devices themselves are suggested to only be operated in closed and properly secured environments as they usually carry sensitive data and operate critical processes.

SPRECON-E: not affected

SPRECON-V: affected (Editor)

The vulnerability is present on all systems with a vulnerable version of the SPRECON-V460 editor installed. Under specific circumstances the SPRECON-V460 editor may load dll files provided by an attacker from a directory for which no administrator rights are required for writing files and execute code of the attacker in the context of the user that started the SPRECON-V460 editor explicitly open the .wsp6 file from this location. Systems with only the SPRECON-V460 runtime installed, are not affected.

A CVSS v3 base score of 7.8 has been calculated for this vulnerability, which is identified as CVE-2019-15638.

Oatchas are available from version 7.50. Also, it is recommended that .wp6 files must not be executed by default via SPRECON-V460 Editor. Additonal application whitelisting can also be used to mitigate this vulnerability.

SPRECON-E: partly affected
SPRECON-V: not affected

Netflix discovered a critical vulnerability based on the combination of TCP Selective Acknowledgement (SACK) and TCP Minimum Segment Size (MSS) in Linux kernels. The sending of specific sequences of TCP SACK packets with low MSS can cause an Integer-Overflow, leading to kernel-panic. Hence, a denial-of-service can be the consequence leasind to potential unavailability of the device.
An analysis for SPRECON-E systems lead to the result, that only FALCON (PU244x) and T3 MC33/34 product series are affected by the following CVEs:

• CVE-2019-11477 (CVSS 3.0 Base Score 7.5)
• CVE-2019-11478 (CVSS 3.0 Base Score 7.5)
• CVE-2019-11479 (CVSS 3.0 Base Score 7.5)
   

Recommendation
By implementing the follwing firewall rule to SPRECON devices, the risk can be mitigated as packets with low MSS will be dropped:
iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP

Additionally, Sprecher Automation is working towards firmware fixes that close this vulnerability directly.

Nevertheless the general recommendation is to operate SPRECON control and protection devices only within isolated process networks, where proper network segmentation is in place. On potential external firewalls that build the zone boundary, similar measures for filtering packets with low MSS should be implemented. By doing so, the risk of this vulnerability can drastically be reduced.

Further details:
https://www.cert.at/warnings/all/20190618.html
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md

SPRECON-E: affected
SPRECON-V: not affected

The web interface (“SPRECON Webserver”) of the SPRECON components suffers from a path traversal vulnerability. A user which is authenticated on the web interface can download files with the permissions of the webserver (www-data). Files like "/etc/shadow" are not readable for the webserver, this is due to SPRECON’s defence-in-depth architecture.

Limitation:

• This vulnerability is only available if EDIR function is respectively was in use on the respective device. Also, a potential attacker needs valid authentication credentials (i.e. username + password) for the web interface.

Solution: 

• Sprecher Automation fixed the vulnerability with firmware version 8.62 (and all subsequent releases). For longterm versions, the releases 8.52g and 8.56f will fix this vulnerability.

Workaround:

• If access control (RBAC) is activated, it is not possible to exploit this vulnerability without having valid user credentials. It is strongly recommended to always activate user authentication on all configuration interfaces. Also, network segmentation is recommended in order to protect network access to IEDs respectively their interfaces.

CVSSv2 Base Score: 2.1
CVSSv3 Base Score: 2.6

More details can be found in the attached advisory.

Acknowledgements:
Thanks to Mr. Erik Huemer from Austrian Energy CERT / CERT.at / NIC.at

Authenticated path traversal Vulnerability

SPRECON-E: not affected
SPRECON-V: affected

The WibuKey software is used for dongle licensing by the SPRECON-V460 editor, SPRECON-V460 runtime, SPRECON-V460 web server, SPRECON-V460 logic runtime, straton runtime, SPRECON-V460 logic workbench and the straton workbench, and for some versions is part of the installation of these software products.

SPRECON-V460 versions 8.00 and higher exclusively use the CodeMeter Software from Wibu Systems and are not affected by these vulnerabilities.

The SPRECON-V460 Analyzer exclusively uses the CodeMeter Software from Wibu Systems and is not affected by these issues.

Affected Components:

• Systems, where the SPRECON-V460 editor, SPRECON-V460 runtime, SPRECON-V460 web server, SPRECON-V460 logic runtime, straton runtime, SPRECON-V460 logic workbench, or straton workbench have been installed, may contain an installation of the WibuKey Runtime software and are potentially affected.
• Systems, where the WibuKey Runtime software has been installed manually, as a WibuKey Network Server for hosting a WibuKey network dongle, are potentially affected.
• Systems, that use green WibuKey dongles (centronics parallel interface, USB, other) require the WibuKey Software.
• Systems, that use silver CodeMeter dongles, use the CodeMeter Runtime software and do not require the WibuKey Software.

Note: The WibuKey Runtime software and / or WibuKey Dongles may also be used by software products from other vendors

Affected Version: 

• WibuKey Software versions 6.40 and older are affected
• SPRECON-V460 products versions 7.20 and older are affected
• SPRECON-V460 products versions 7.50 and 7.60 may be affected if the WibuKey software has been installed manually, to support a WibuKey dongle
• straton products versions 9.2 and older are affected
   

Patch Availability:

Wibu Systems provides an updated version 6.50b – build 3323 of the WibuKey software that addresses the reported vulnerabilities.
Earlier in December 2018, Wibu Systems provided an updated version 6.50 of the WibuKey software that also addresses the reported vulnerabilities but contains interoperability issues with SPRECON-V460 products and parallel dongles.
The “WibuKey Runtime for Windows” software version 6.50b can be downloaded following this link:

https://www.wibu.com/support/user/downloads-user-software.html

Known Issues:

The version 6.50 build 3307 of the WibuKey Runtime for Windows software has a known issue with parallel WibuKey dongles. On start-up of the SPRECON-V460 editor or the SPRECON-V460 runtime, an error message appears stating “Licensing failed: Function = WkbSelect2() The specified parameter is invalid (4)”. Acknowledging the error allows a normal start of the application with the license intact.

Mitigation:

With versions SPRECON-V460 7.20 and older, the WibuKey Runtime software is installed automatically by the setup procedure, in order to be able to use WibuKey dongles without requiring a manual installation of this software.

When the installed product uses either a CodeMeter Dongle or a soft license, the WibuKey Runtime software is not needed and can be uninstalled through the Windows control panel. Uninstalling the WibuKey Runtime software removes the vulnerabilities.

When the installed product uses a WibuKey Dongle, uninstalling the WibuKey Runtime software removes the vulnerabilities but also fails to start the product with a valid Dongle License. In this case there is no mitigation and the updated version must be installed.

With versions SPRECON-V460 7.50 and 7.60, the WibuKey Runtime software is no longer installed automatically as part of the setup procedure but is delivered together with the installation media. It is therefore possible, that the WibuKey Runtime software has been installed manually at some point but may not, or may no longer, be needed.

General Recommendations:

Sprecher Automation generally recommends restricting local physical access to authorized people only. Network access shall be limit to communication that is absolutely required.

Using VLANs and firewalls to segment network traffic and create zones and conduits, reduces exposure of vulnerable systems and allows access to a WibuKey WkLAN Server to be restricted to only those systems that are in fact using a network dongle. It is recommended that systems hosting a WibuKey WkLAN Server are not facing external networks.

Sprecher Automation further recommends using application whitelisting to restrict execution of applications to only those applications that are required for the operation of the system.
 

SPRECON-E: partly affected
SPRECON-V: not affected

SPRECON-E: Kernel Update with Firmware 8.59

An update of SPRECON's operating-system-kernel has been finished. This update of the Linux kernel improves the defence-in-depth strategy of SPRECON-E products.
Details can be found in the release-notes of SPRECON-E Control 8.59 firmware.

SPRECON-V: partly affected

We can confirm that the following updates resolve several issues, caused by the Microsoft Security Update at the beginning of the year 2018.
 

• KB4074594 resolves KB4056898 - Windows 8.1. for x64-based Systems

• KB4074594 resolves KB4056895 and KB4056898 - Windows 8.1 and Windows Server 2012 R2 Standard

• KB4074592 resolves KB4056891 - Windows 10 Version 1703 for x64-based Systems

• KB4074596 resolves KB4056893 - Windows 10 Version 1507 for x64-based Systems

• KB4074590 resolves KB4056890 - Windows Server 2016 and Windows 10 Version 1607

• KB4074593 resolves KB4056896 - Windows Server 2012 Standard

• KB4074598 resolves KB4056894 - Windows 7 and Windows Server 2008 R2

As already published in public media, several CPU chips from renowned manufacturers (Intel, AMD, etc.) are affected. Meltdown and Spectre use vulnerabilities such as faulty kernel-mappings in order to read arbitrary data from memory and disclose sensitive information.
A potential attacker would need to download malicious software to the system, execute it, and extract the results in order to use these attacks.

As SPRECON-V can be applied on various computer hardware, it depends on the used hardware wether the proper installation is affected or not. For complete mitigation, operation system patches will need to be applied as soon as they can be installed without problems.

! At the moment, it has been recognized that several Microsoft Windows patches lead to problems. It is not recommended to apply these patches directly to the operational system. In case they shall be applied, it is recommended to first create a backup of the systems, and first apply the patches to an equivalent test system and check the functionality after patching. Alternative countermeasures as below can be applied. !

Additional analysis is currently being done. As soon as Microsoft Windows patches can be installed, hence are appoved by Sprecher Automation, this information will be shared.

Affected Products:

• SPRECON-V460 if operated on affected hardware: Intel, AMD, ARM
• https://www.heise.de/newsticker/meldung/Prozessor-Luecken-Meltdown-und-Spectre-Intel-und-ARM-fuehren-betroffene-Prozessoren-auf-Nvidia-3934667.html
• https://www.cvedetails.com/cve-details.php?cve_id=CVE-2017-5754

Countermeasures:

• Technical/operational networks must be isolated from public networks

• All communication means that lead into an operational network need to be monitored

• HMI-stations within operational networks / stations should be additionally hardened (application whitelisting and/or antivirus software)

• Enforcement of security monitoring in all areas and networks in order to detect anomalies

• Strictly apply defence-in-depth in your networks

• Chip and operating system manufacturers already work towards possible patches

• Recommendations of respective manufacturers can be considered to be implemented in the affected stations

Microsoft offers tools in order to prove if the hardware is affected: https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in

Links:

Meltdown and Spectre,
http://meltdownattack.com

Google Security Blog,
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html

COPADATA
https://www.copadata.com/en/news/news/security-announcement-6943/

SPRECON-E: partly affected

As already published in public media, several CPU chips from renowned manufacturers (Intel, AMD, etc.) are affected. One of these affected products is used within SPRECON-E Falcon CPUs (PU244x) on ARM basis. Other SPRECON-E products respectively CPU families are not affected. However, the resulting risk is marginal for SPRECON devices.

Followingly the facts about this:        

• Meltdown is not relevant to ARM chips, hence, no risk from this attack
• Regarding Spectre, the variants 1 and 2 according to ^[1] are relevant. Hence, CVE-2017-5753 and CVE-2017-5715.
• in order to exploit these vulnerabilities, a potential attacker would need to download malicious software to the device, execute it, and extract the results. Theoretically, this could lead to disclosure of sensitive data, which would compromise the confidentiality of data, but not directly compromise integrity or availability of the device.
• However, SPRECON realizes a strict defence-in-depth strategy. This means, that there is no way to download arbitrary data on the device and execute downloaded code. Every means to download data onto the device is limited to authentic configuration data within the available engineering-worklfow on SPRECON. Hence, the risk from this vulnerability is minimal.

^[1] developer.arm.com/support/security-update

Affected Products:

• SPRECON-E-C respectively SPRECON-E-P with CPU PU244x

Links:

• There is no need for action regarding the attacks Meltdown and Spectre.