Siemens Multiple Products Out-of-bounds Write (CVE-2021-4034)

high Tenable OT Security Plugin ID 501030

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Siemens recommends users update products to the following versions:

- SCALANCE LPE9403: Update to v2.0 or later.
- SINUMERIK Edge: Update to v3.3.0 or later using the product’s internal update mechanism.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:

- Restrict system access to authorized personnel and follow a least privilege approach
- Temporary mitigation exists at the expense of pkexec’s capabilities. By removing SUID permissions, the program cannot run processes as root. However, any processes that rely on it for normal operation will be affected (SUID permission can be removed with chmod, as follows: chmod 0755 /usr/bin/pkexec)

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see Siemens Security Advisory SSA-330556

Plugin Details

Severity: High

ID: 501030

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 4/11/2023

Updated: 12/19/2023

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Critical

Score: 9.8

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-4034

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:scalance_lpe9403_firmware

Required KB Items: Tenable.ot/Siemens

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/28/2022

Vulnerability Publication Date: 1/28/2022

CISA Known Exploited Vulnerability Due Dates: 7/18/2022

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Local Privilege Escalation in polkits pkexec)

Reference Information

CVE: CVE-2021-4034

CWE: 125, 787

Detections

Analytics