Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Recently Patched Dnsmasq Flaws Affect Siemens Industrial Devices

Some of the vulnerabilities discovered recently by Google researchers in the Dnsmasq network services software affect several Siemens SCALANCE industrial communications products.

Some of the vulnerabilities discovered recently by Google researchers in the Dnsmasq network services software affect several Siemens SCALANCE industrial communications products.

Dnsmasq is a lightweight tool designed to provide DNS, DHCP, router advertisement and network boot services for small networks. It can be found in Linux distributions, smartphones, routers, and many Internet of Things (IoT) devices.

Google’s security team recently found that the tool is affected by seven flaws, including ones that can be exploited via DNS or DHCP for remote code execution, information disclosure, and denial-of-service (DoS) attacks. Linux distributions, Amazon, Cisco, Synology, Sophos and other companies warned customers about the potential risks shortly after the issues were disclosed in early October.Dnsmasq flaws affect Siemens products

Earlier this month, Siemens also published an advisory to inform customers that four of the seven vulnerabilities affect some of its SCALANCE products, including W1750D controller-based direct access points, M800 industrial routers, and S615 firewalls.

Three of the flaws affecting Siemens devices, CVE-2017-13704, CVE-2017-14495 and CVE-2017-14496, can be exploited to crash the Dnsmasq process by sending specially crafted requests to the service on UDP port 53.

The SCALANCE products are also impacted by CVE-2017-14491, one of the most serious vulnerabilities discovered by Google researchers in Dnsmasq. This security hole allows an attacker to cause a DoS condition or possibly execute arbitrary code.

“In order to exploit this vulnerability, an attacker must be able to trigger DNS requests from the device, and must be in a position that allows him to inject malicious DNS responses, e.g. the attacker must be in a Man-in-the-Middle position,” Siemens said.

The company says it’s preparing patches for the vulnerable products. In the meantime, it has advised customers to apply defense-in-depth recommendations, deploy firewall rules to block incoming traffic on UDP port 53 (applies to W1750D if OpenDNS, Captive

Portal or URL redirection functionality is not used), and disable the DNS proxy and configure devices to use a different DNS server (applies to M800 and S615).

Advertisement. Scroll to continue reading.

Siemens has also reported the vulnerabilities to ICS-CERT, which also published an advisory this week.

Related: Flaw in Siemens RTU Allows Remote Code Execution

Related: Serious Flaw Exposes Siemens Industrial Switches to Attacks

Related: Siemens, PAS Partner on Industrial Cybersecurity

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Kenna Security co-founder Ed Bellis has joined Empirical Security as Chief Executive Officer.

Robert Shaker II has joined application security firm ActiveState as Chief Product and Technology Officer.

MorganFranklin Cyber has promoted Nick Stallone and Ferdinand Hamada into newly created roles.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.