Emerson ROC800 Multiple Vulnerabilities
All information products included in http://ics-cert.us-cert.gov are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/.
This advisory was originally posted to the US-CERT secure Portal library on September 16, 2013, and is now being released to the ICS-CERT Web page.
This advisory provides mitigation details for multiple vulnerabilities affecting the Emerson Process Management’s ROC800 remote terminal units (RTUs) products (ROC800, ROC800L, and DL8000).
Researchers Dillon Beresford, Brian Meixell, Marc Ayala, and Eric Forner of Cimation have identified multiple vulnerabilities in Emerson Process Management’s ROC800 RTU products. Emerson Process Management has produced a patch that mitigates these vulnerabilities. The researchers have tested the patch to validate that it resolves the vulnerabilities.
These vulnerabilities can be exploited remotely.
The following Emerson Process Management RTUs are affected:
- ROC800 Version 3.50 and prior,
- DL8000 Version 2.30 and prior, and
- ROC800L Version 1.20 and prior.
An attacker who exploits these vulnerabilities could disable the device, compromise the device integrity, and remotely execute code on the target system.
Impact to individual organizations depends on many factors that are unique to each organization. ICS‑CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation.
Emerson Process Management is a global manufacturing and technology company offering multiple products and services in the industrial, commercial, and consumer markets through its network power, process management, industrial automation, climate technologies, and tools and storage businesses.
The affected product, the ROC800 RTU, can perform many PLC-like functions for controlling devices. It is widely used in oil and gas pipelines, but can also be used as a general purpose controller in other applications. Emerson Process Management estimates that these products are used primarily in the United States and Europe with a small percentage in Asia.
Each of the identified vulnerabilities is described in this section, organized according to the common weakness enumeration (CWE) vulnerability type.
In the case of the ROC800 RTU, there are three separate hidden functionality vulnerabilities that are described below. Each of these hidden capabilities increases the attack surface for the device and can be exploited by an attacker.
OSE DEBUG BROADCAST
The ROC800 RTU runs the ENEA OSE operating system. The kernel running on the ROC800 device broadcasts a network beacon allowing easier detection of the OSE Debug vulnerability. This vulnerability could be exploited remotely.
OSE DEBUG SERVICE
The ROC800 RTU kernel has a port available for attaching a debug tool. A device with a running debug service allows debuggers to attach and remotely debug code on the device and is intended to be enabled, only on development systems and never on a production device. An attacker can remotely attach to the device and alter memory, registers, process states, and ultimately have full control of the device. This vulnerability could be exploited remotely.
A TFTP server is available on the ROC800 RTU. A TFTP service is used for transferring files to a network attached device. The issue with the existence of this service is that arbitrary files can potentially be uploaded. This vulnerability could be exploited remotely.
USE OF HARD-CODED CREDENTIALSh
Hard-coded accounts with passwords have been discovered in the ROC800 ROM. An attacker could have access to the operating system command shell and/or obtain authentication information for all ROC800 devices. These vulnerabilities could be exploited remotely.
All the vulnerabilities described in this advisory are remotely exploitable and can be used by an attacker to compromise the ROC800 device to varying degrees, including several that can result in the complete compromise of the device.
EXISTENCE OF EXPLOIT
No known public exploits specifically target these vulnerabilities.
An attacker with a low skill would be able to exploit these vulnerabilities.
The best mitigation for these vulnerabilities is to install the vendor patch. The Emerson Process Management patch is available via the following Web link of which a user name and password is required:
ICS‑CERT encourages asset owners to take additional defensive measures to protect against this and other cybersecurity risks.
- Minimize network exposure for all control system devices. Critical devices should not directly face the Internet.
- Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPN is only as secure as the connected devices.
ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT Web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.k ICS‑CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.
Additional mitigation guidance and recommended practices are publicly available in the ICS‑CERT Technical Information Paper, ICS-TIP-12-146-01B—Targeted Cyber Intrusion Detection and Mitigation Strategies,l that is available for download from the ICS-CERT Web page (http://ics-cert.us-cert.gov/).
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS‑CERT for tracking and correlation against other incidents.
- a. CWE-912: Hidden Functionality, http://cwe.mitre.org/data/definitions/912.html, Web site last accessed September 26, 2013.
- b. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0693, NIST uses this advisory to create the CVE Web site report. This Web site will be active sometime after publication of this advisory.
- c. CVSS Calculator, http://nvd.nist.gov/cvss.cfm?version=2&vector=AV:N/AC:L/Au:N/C:C/I:C/A:C, Web site last accessed September 26, 2013.
- d. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0692, NIST uses this advisory to create the CVE Web site report. This Web site will be active sometime after publication of this advisory.
- e. CVSS Calculator, http://nvd.nist.gov/cvss.cfm?version=2&vector=AV:N/AC:L/Au:N/C:C/I:C/A:C, Web site last accessed September 26, 2013.
- f. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0689, NIST uses this advisory to create the CVE Web site report. This Web site will be active sometime after publication of this advisory.
- g. CVSS Calculator, http://nvd.nist.gov/cvss.cfm?version=2&vector=AV:N/AC:L/Au:N/C:C/I:C/A:C, Web site last accessed September 26, 2013.
- h. CWE-798: Use of Hard-coded Credentials, http://cwe.mitre.org/data/definitions/798.html, Web site last accessed September 26, 2013.
- i. NVD, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0694, NIST uses this advisory to create the CVE Web site report. This Web site will be active sometime after publication of this advisory.
- j. CVSS Calculator, http://nvd.nist.gov/cvss.cfm?version=2&vector=AV:N/AC:L/Au:S/C:C/I:C/A:C, Web site last accessed September 26, 2013.
- k. CSSP Recommended Practices, http://ics-cert.us-cert.gov/content/recommended-practices, Web site last accessed September 26, 2013.
- l. Targeted Cyber Intrusion Detection and Mitigation Strategies, http://ics-cert.us-cert.gov/tips/ICS-TIP-12-146-01B, Web site last accessed September 26, 2013.
For any questions related to this report, please contact ICS-CERT at:
Toll Free: 1-877-776-7585
International Callers: (208) 526-0900
For industrial control systems security information and incident reporting: http://ics-cert.us-cert.gov
ICS-CERT continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.