An ICS advisory has highlighted multiple vulnerabilities in Siemens’ Telecontrol Server Basic equipment. The vulnerabilities, which include Inadequate Encryption Strength, Double Free, Integer Overflow or Wraparound, External Control of File Name or Path, Path Traversal, Improper Input Validation, Missing Encryption of Sensitive Data, Use After Free, Improper Certificate Validation, Inefficient Regular Expression Complexity, Improper Check for Unusual or Exceptional Conditions, NULL Pointer Dereference, and Improper Restriction of Operations within the Bounds of a Memory Buffer, could be exploited remotely with low attack complexity. The affected product is Siemens TeleControl Server Basic V3, specifically versions prior to V3.1.2.
One of the vulnerabilities, Inadequate Encryption Strength (CWE-326), involves a timing-based side channel in the OpenSSL RSA decryption implementation. This could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages for decryption. This vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP, and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages, the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
