U.S. Flag Official website of the Department of Homeland Security

Advisory (ICSA-13-259-01)

Emerson ROC800 Multiple Vulnerabilities

Original release date: September 26, 2013

Legal Notice

All information products included in http://ics-cert.us-cert.gov are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/.



OVERVIEW

This advisory was originally posted to the US-CERT secure Portal library on September 16, 2013, and is now being released to the ICS-CERT Web page.

This advisory provides mitigation details for multiple vulnerabilities affecting the Emerson Process Management’s ROC800 remote terminal units (RTUs) products (ROC800, ROC800L, and DL8000).

Researchers Dillon Beresford, Brian Meixell, Marc Ayala, and Eric Forner of Cimation have identified multiple vulnerabilities in Emerson Process Management’s ROC800 RTU products. Emerson Process Management has produced a patch that mitigates these vulnerabilities. The researchers have tested the patch to validate that it resolves the vulnerabilities.

These vulnerabilities can be exploited remotely.

AFFECTED PRODUCTS

The following Emerson Process Management RTUs are affected:

  • ROC800 Version 3.50 and prior,
  • DL8000 Version 2.30 and prior, and
  • ROC800L Version 1.20 and prior.

IMPACT

An attacker who exploits these vulnerabilities could disable the device, compromise the device integrity, and remotely execute code on the target system.

Impact to individual organizations depends on many factors that are unique to each organization. ICS‑CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.

BACKGROUND

Emerson Process Management is a global manufacturing and technology company offering multiple products and services in the industrial, commercial, and consumer markets through its network power, process management, industrial automation, climate technologies, and tools and storage businesses.

The affected product, the ROC800 RTU, can perform many PLC-like functions for controlling devices. It is widely used in oil and gas pipelines, but can also be used as a general purpose controller in other applications. Emerson Process Management estimates that these products are used primarily in the United States and Europe with a small percentage in Asia.

VULNERABILITY CHARACTERIZATION

VULNERABILITY OVERVIEW

Each of the identified vulnerabilities is described in this section, organized according to the common weakness enumeration (CWE) vulnerability type.

HIDDEN FUNCTIONALITYa

In the case of the ROC800 RTU, there are three separate hidden functionality vulnerabilities that are described below. Each of these hidden capabilities increases the attack surface for the device and can be exploited by an attacker.

OSE DEBUG BROADCAST

The ROC800 RTU runs the ENEA OSE operating system. The kernel running on the ROC800 device broadcasts a network beacon allowing easier detection of the OSE Debug vulnerability. This vulnerability could be exploited remotely.

CVE-2013-0693b has been assigned to this vulnerability. A CVSS v2 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/Au:N/C:C/I:C/A:C).c

OSE DEBUG SERVICE

The ROC800 RTU kernel has a port available for attaching a debug tool. A device with a running debug service allows debuggers to attach and remotely debug code on the device and is intended to be enabled, only on development systems and never on a production device. An attacker can remotely attach to the device and alter memory, registers, process states, and ultimately have full control of the device. This vulnerability could be exploited remotely.

CVE-2013-0692d has been assigned to this vulnerability. A CVSS v2 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/Au:N/C:C/I:C/A:C).e

TFTP SERVER

A TFTP server is available on the ROC800 RTU. A TFTP service is used for transferring files to a network attached device. The issue with the existence of this service is that arbitrary files can potentially be uploaded. This vulnerability could be exploited remotely.

CVE-2013-0689f has been assigned to this vulnerability. A CVSS v2 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/Au:N/C:C/I:C/A:C).g

USE OF HARD-CODED CREDENTIALSh

Hard-coded accounts with passwords have been discovered in the ROC800 ROM. An attacker could have access to the operating system command shell and/or obtain authentication information for all ROC800 devices. These vulnerabilities could be exploited remotely.

CVE-2013-0694i has been assigned to this vulnerability. A CVSS v2 base score of 9.0 has been assigned; the CVSS vector string is (AV:N/AC:L/Au:S/C:C/I:C/A:C).j

VULNERABILITY DETAILS

EXPLOITABILITY

All the vulnerabilities described in this advisory are remotely exploitable and can be used by an attacker to compromise the ROC800 device to varying degrees, including several that can result in the complete compromise of the device.

EXISTENCE OF EXPLOIT

No known public exploits specifically target these vulnerabilities.

DIFFICULTY

An attacker with a low skill would be able to exploit these vulnerabilities.

MITIGATION

The best mitigation for these vulnerabilities is to install the vendor patch. The Emerson Process Management patch is available via the following Web link of which a user name and password is required:

http://www3.emersonprocess.com/remote/support/support_login.html

ICS‑CERT encourages asset owners to take additional defensive measures to protect against this and other cybersecurity risks.

  • Minimize network exposure for all control system devices. Critical devices should not directly face the Internet.
  • Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPN is only as secure as the connected devices.

ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT Web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.k ICS‑CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.

Additional mitigation guidance and recommended practices are publicly available in the ICS‑CERT Technical Information Paper, ICS-TIP-12-146-01B—Targeted Cyber Intrusion Detection and Mitigation Strategies,l that is available for download from the ICS-CERT Web page (http://ics-cert.us-cert.gov/).

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS‑CERT for tracking and correlation against other incidents.


Contact Information

For any questions related to this report, please contact ICS-CERT at:

Email: ics-cert@hq.dhs.gov
Toll Free: 1-877-776-7585
International Callers: (208) 526-0900

For industrial control systems security information and incident reporting: http://ics-cert.us-cert.gov

ICS-CERT continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top