Cybersecurity

The NCCIC has published an advisory on an improper authorization vulnerability in Siemens Network Planner (SINETPLAN). Version 2.0 is affected. Successful exploitation of this vulnerability could allow information disclosure, code execution, and denial-of-service. Siemens recommends users update TIA Administrator to Version 1.0 SP1 Upd1. The NCCIC also recommends a series of measures to mitigate the vulnerability. Read the advisory at CISA.

September 5, 2019

The NCCIC has updated this advisory with additional details on the mitigation measures. Read the advisory at CISA.

February 19, 2019

The NCCIC has published an advisory on use after free, improper restriction of operations within the bounds of a memory buffer, pointer issues, and use of hard-coded cryptographic key vulnerabilities in Red Lion Controls Crimson. Versions 3.0 and prior and versions 3.1 and prior, to release 3112.00, are affected. Red Lion Controls recommends users migrate to Crimson 3.1 release 3112.00 or later where the model choice allows. The NCCIC also recommends a series of measures to mitigate the vulnerabilities.

U.S. Cyber Command has uploaded 11 malware samples to the malware aggregation tool and repository VirusTotal. Several of the samples have been attributed to the North Korean government. The upload comes as Cyber Command works to enhance its relationship with the private sector – it has only been sharing samples since last year. Read the article at CyberScoop.