Siemens WinCC 7.2 Multiple Vulnerabilities

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact the Siemens WinCC Web Navigator 7.2. Researchers Alexander Tlyapov, Sergey Gordeychik, and Timur Yunusov of Positive Technologies have identified multiple vulnerabilities in the Siemens WinCC Web Navigator 7.2...

PT-2013-2521

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description The issue allows remote authenticated users to obtain sensitive information via a SQL query due to improper assignment of privileges for the database...

PT-2013-2523

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description The issue is related to the improper representation of WebNavigator credentials in a database. This makes it easier for remote authenticated users to obtain...

PT-2013-2515

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue concerns a CRLF injection vulnerability in the HMI web application. This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attac...

PT-2013-2524

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description A directory traversal issue in the web server allows remote authenticated users to read arbitrary files by querying a pathname. Recommendations For Siemens...

PT-2013-2512

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description A cross-site scripting XSS issue exists in the HMI web application, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to unauthorized...

PT-2013-2517

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description A cross-site scripting XSS issue exists in the HMI web application, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified data. This could potentially lead to...

PT-2013-2519

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description The issue is related to a buffer overflow in the RegReader ActiveX control. This allows remote attackers to execute arbitrary code via a long parameter...

PT-2013-2522

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description The issue allows remote attackers to obtain sensitive information or cause a denial of service by using a crafted project file. Recommendations For Siemens...

PT-2013-2520

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 SIMATIC PCS7 versions prior to 8.0 SP1 Description A buffer overflow issue exists in the CCEServer component of Siemens WinCC, which can be exploited by remote attackers to cause a denial of service. This is...

PT-2013-2516

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL. Recommendations For version 11, update to a version that fixes this...

CVE-2013-0679: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote authenticated users to read arbitrary files via vectors involving a query for a pathname...

CVE-2013-0670: Improper Input Validation

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

PT-2013-1459

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue allows local users to obtain sensitive information by leveraging physical access or Sm@rt Server access, due to the use of a reversible algorithm for storing HMI web-application passwor...

PT-2013-2514

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon crash, by sending a crafted HTTP request to the HMI web application. Recommendations For version 11...

CVE-2013-0678: Undefined Security Weakness

Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly represent WebNavigator credentials in a database, which makes it easier for remote authenticated users to obtain sensitive information via a SQL query...

CVE-2013-0675: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in CCEServer aka the central communications component in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to cause a denial of service via a crafted packet...

CVE-2013-0674: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter...

CVE-2013-0676: Undefined Security Weakness

Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly assign privileges for the database containing WebNavigator credentials, which allows remote authenticated users to obtain sensitive information via a SQL query...

CVE-2013-0677: Exposure of Sensitive Information to an Unauthorized Actor

The web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to obtain sensitive information or cause a denial of service via a crafted project file...