Summary
The FTP server of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Vulnerabilities 1
-
High 7.5
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All ve…
Revision history
-
#3
Added fix for Nucleus NET in Nucleus PLUS V1, V2, and for Nucleus ReadyStart V2012
-
#2
Added specific mitigation
-
#1
Publication Date
References
-
SSA-313313: Denial of Service Vulnerability in the FTP Server of Nucleus RTOS - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-313313.txt
-
SSA-313313: Denial of Service Vulnerability in the FTP Server of Nucleus RTOS - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-313313.pdf
-
ICS Advisory ICSA-22-286-07 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-286-07
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B