Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management //

Patch Management

9/17/2018
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Fuji's Electric V-Server Susceptible to Numerous Vulnerabilities

Another industrial control system is shown to have a series of serious flaws. This time, it's Fuji's Electric V-Server, according to warnings from ICS-CERT.

Fuji's Electric V-Server is in some heap of trouble.

An advisory from ICS-CERT enumerates several code vulnerabilities in the industrial control system's (ICS) data collection and management service. V-Server VPR 4.0.3.0, as well as prior versions, are reported to be affected.

The vulnerabilities include use-after-free, untrusted pointer dereference, heap-based buffer overflow, out-of-bounds write, integer underflow, out-of-bounds read and stack-based buffer overflow.

These numerous vulnerabilities could leads to distributed denial-of-service (DDoS) attacks or possible information disclosure to an attacker.

Boy howdy, some heap of trouble indeed.

ICS-CERT also warned that public exploits are available for some of the vulnerabilities.

The CVSS base score for the faults has been calculated as 7.3 -- a "high severity" rating. This means they are important, but not deemed immediately critical to operations.

However, Fuji says that all the vulnerabilities have been patched with the release of version 4.0.4.0.

The first reporting of the problem is credited to Trend Micro's Zero Day Initiative (ZDI) with the research conducted by Steven Seeley of Source Incite.

In the advisory published by ZDI, researchers note that first disclosure to the manufacturer was sent in March. The coordinated public release of advisory was released September 12.

The advisory notes that the problem "exist within the parsing of a VPR file." With the bad parsing, either the lack of validating the existence of an object prior to performing operations on that object, or the lack of proper validation for user-supplied data causes some of the issues.

An additional advisory from ICS-CERT describes a high severity buffer overflow, which affects V-Server Lite. The problem is open to exportation for code execution -- leading to a DDoS condition or information leakage once again -- using specially crafted project files.

Even with the new software installed, the National Cybersecurity & Communications Integration Center (NCCIC) recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Specifically, the following concepts should be considered when looking at the ICS system as a whole:

  • Minimize network exposure for all control system devices or systems, and ensure that they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also, it must be recognized that a VPN is only as secure as the connected devices.

The security team must always be aware how easy it is to get to ICS systems from a non-secure corporate perimeter. The usual reason is misconfiguration.

Positive Technologies found in a report that 73% of studied corporate networks allowed penetration by some means. Weak passwords, along with vulnerable software and operating systems, as well as flaws in network segmentation -- no DMZ -- and traffic filtering were the most commonly found issues.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.