|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
 |
Vulnerability Note VU#144233
Rockwell Automation Allen-Bradley MicroLogix PLC authentication and authorization vulnerabilities
OverviewRockwell Automation Allen-Bradley MicroLogix programmable logic controllers (PLCs) do not adequately authenticate or authorize remote connections or commands. An attacker with network access can obtain the management password or issue commands that bypass the authentication mechanism.
I. DescriptionRockwell Automation Allen-Bradley MicroLogix PLCs do not adequately authenticate or authorize remote connections or commands. Two vulnerable behaviors have been reported:
- During the authentication process, the PLC transmits the management password in plain text to the client.
- When processing remote commands, the PLC checks the session ID but not the password. The PLC will execute any command with a valid session ID, and obtaining an ID does not require the password.
It appears that authentication is performed at the client (e.g., RSLogix), as the PLC does not check the password in either case.
These vulnerabilities have been reported in the MicroLogix 1100 PLC. Other products in the MicroLogix series may also be affected.
II. ImpactAn attacker with network access to a controller could obtain the management password or issue commands that bypass the authentication mechanism. The attacker could disable the controller or change the configuration.
III. SolutionUpdated firmware is not available. Consider the workarounds listed below. Also, please see Technotes 65980 and 65982.
Restrict access
To reduce exposure to attacks, restrict network access to PLCs. Following the principle of least privilege, control system networks should not be generally accessible from enterprise networks or the internet. Permit only network traffic that is required for control system operation.
Change passwords
Changing passwords can prevent an attacker from accessing a PLC if the password is changed before the attacker attempts access or if different passwords are used on different PLCs. An attacker with network access can obtain the current password.
Systems Affected
References
http://www.securityfocus.com/archive/1/archive/1/508946/100/0/threaded
http://www.ab.com/programmablecontrol/plc/micrologix/index.html
http://www.rockwellautomation.com/rockwellsoftware/design/rslogix5/
http://rockwellautomation.custhelp.com/app/answers/detail/a_id/65980/kw/65980/r_id/113025
http://rockwellautomation.custhelp.com/app/answers/detail/a_id/65982/kw/65982/r_id/113025
http://www.rockwellautomation.com/solutions/security
Credit
Thanks to Eyal Udassin of C4 Security for researching and reporting these vulnerabilities. Thanks also to Rockwell Automation for providing technical assistance and developing mitigation techniques.
This document was written by Art Manion.
Other Information
| Date Public: | 2009-12-18 |
| Date First Published: | 2010-01-19 |
| Date Last Updated: | 2010-06-03 |
| CERT Advisory: | |
| CVE-ID(s): | CVE-2009-3739 |
| NVD-ID(s): | CVE-2009-3739 |
| US-CERT Technical Alerts: | |
| Metric: | 8.91 |
| Document Revision: | 23 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
|
