Recently Patched Dnsmasq Flaws Affect Siemens Industrial Devices

网络安全法动漫宣传片 002 国家网络安全的现状与重要性概述
Some of the vulnerabilities discovered recently by Google researchers in the Dnsmasq network services software affect several Siemens SCALANCE industrial communications products.
Dnsmasq is a lightweight tool designed to provide DNS, DHCP, router advertisement and network boot services for small networks. It can be found in Linux distributions, smartphones, routers, and many Internet of Things (IoT) devices.
Google’s security team recently found that the tool is affected by seven flaws, including ones that can be exploited via DNS or DHCP for remote code execution, information disclosure, and denial-of-service (DoS) attacks. Linux distributions, Amazon, Cisco, Synology, Sophos and other companies warned customers about the potential risks shortly after the issues were disclosed in early October.
Earlier this month, Siemens also published an advisory to inform customers that four of the seven vulnerabilities affect some of its SCALANCE products, including W1750D controller-based direct access points, M800 industrial routers, and S615 firewalls.
以前,在新员工入职培训中,信息安全的课程是比较粗糙乏味的。近来,我开始播放一些视频,以及让他们做些小问答,反馈很棒!
Three of the flaws affecting Siemens devices, CVE-2017-13704, CVE-2017-14495 and CVE-2017-14496, can be exploited to crash the Dnsmasq process by sending specially crafted requests to the service on UDP port 53.
The SCALANCE products are also impacted by CVE-2017-14491, one of the most serious vulnerabilities discovered by Google researchers in Dnsmasq. This security hole allows an attacker to cause a DoS condition or possibly execute arbitrary code.
“In order to exploit this vulnerability, an attacker must be able to trigger DNS requests from the device, and must be in a position that allows him to inject malicious DNS responses, e.g. the attacker must be in a Man-in-the-Middle position,” Siemens said.
The company says it’s preparing patches for the vulnerable products. In the meantime, it has advised customers to apply defense-in-depth recommendations, deploy firewall rules to block incoming traffic on UDP port 53 (applies to W1750D if OpenDNS, Captive
Portal or URL redirection functionality is not used), and disable the DNS proxy and configure devices to use a different DNS server (applies to M800 and S615).

Siemens has also reported the vulnerabilities to ICS-CERT, which also published an advisory this week.
Related: Flaw in Siemens RTU Allows Remote Code Execution
Related: Serious Flaw Exposes Siemens Industrial Switches to Attacks
Related: Siemens, PAS Partner on Industrial Cybersecurity
错误的或被篡改的不当信息可能会导致错误的决策或商业机会甚至信誉的丧失,企业需保证在电子商务世界中的诚信守法经营形象。

猜您喜欢

【株洲】荷塘区国税局提意识强责任 搭建网络信息安全防护网
网络安全人人有责公益教育短片——APT高级持续性威胁
网络安全法视频宣传片 第二集 国家网络安全的现状与重要性概述
李克强出席"16+1合作"五周年纪念活动
MANILAGRACE MISSIONINTERFACE
敏感信息保护案例视频——拍照泄密