full-disclosure - [FD] Siemens, Climatix BACnet/IP communication module, Vulnerabilities

Open Source and information security mailing list archives

Date: Tue, 30 Jun 2015 15:29:49 +0200
From: Fran <jfrancisco.bolivar@...il.com>
To: bugtraq <bugtraq@...urityfocus.com>, fulldisclosure@...lists.org
Subject: [FD] Siemens, Climatix BACnet/IP communication module,
	Vulnerabilities

I. VULNERABILITIES
-------------------------

1. Reflected XSS Attack vulnerability in Climatix BACnet/IP communication
module from Siemens

2. Unrestricted upload of files

II. BACKGROUND
-------------------------

BACnet/IP communication modules help to integrate controller types POL6XX
of the Climatix family into BACnet networks

III. DESCRIPTION
-------------------------

1. XSS,Has been detected Reflected XSS vulnerability

http://IPDIRECTION/bgi/dumpfile.dll?")</b><script>alert("hacked");</script>

2. Unrestricted upload of files:

http://IPDIRECTION/bgi/filemanager.dll#upload

V. BUSINESS IMPACT
-------------------------

An attacker can execute arbitrary HTML or script code in a targeted
user's browser, that allows the execution of arbitrary HTML/script
code to be executed in the context of the victim user's browser
allowing Cookie Theft/Session Hijacking, thus enabling full access the
box.

The box can be compromised due to upload of files and execution.

VI. SYSTEMS AFFECTED
-------------------------

Climatix BACnet/IP communication module: All versions < V10.34

VII. SOLUTION
-------------------------

Siemens provides firmware update Climatix BACnet/IP communication module
V10.34 which fixes the vulnerability (XSS).

The new firmware update includes further security improvements (e.g. web
server
authentication enabled by default) due to  vulnerabilities founded like
uncontrolled upload of files and unrestricted execution of dangerous
functions like "shell.exe" and "cmd.exe".

Siemens Security Advissory:
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-142512.pdf

ICS-CERT: https://ics-cert.us-cert.gov/advisories/ICSA-15-176-01

Detected and reported by J. Francisco Bolivar (es.linkedin.com/in/jfbolivar/)
@Jfran_cbit

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives