SB2015040302 - Multiple vulnerabilities in facade.company Ignition

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Credentials management (CVE-ID: CVE-2015-0995)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack.

2) Security Features (CVE-ID: CVE-2015-0994)

The vulnerability allows a remote #AU# to manipulate data.

Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests.

3) Security Features (CVE-ID: CVE-2015-0993)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.

4) Information disclosure (CVE-ID: CVE-2015-0992)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.

5) Information disclosure (CVE-ID: CVE-2015-0991)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.

6) Cross-site scripting (CVE-ID: CVE-2015-0976)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in Inductive Automation Ignition 7.7.2. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01