{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "VDLab"
        ],
        "organization": "Venustech and Dongfang Electric Corporation (DEC)",
        "summary": "reporting these vulnerabilities to NCCIC"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities may allow privilege escalation or remote code execution, or it may halt the controller.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Electrical (Power Generation), Water and Wastewater",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "NCCIC also recommends that users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-148-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2019/icsa-19-148-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-148-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-148-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-148-01"
      }
    ],
    "title": "Emerson Ovation OCR400 Controller",
    "tracking": {
      "current_release_date": "2019-05-28T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-19-148-01",
      "initial_release_date": "2019-05-28T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2019-05-28T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-19-148-01 Emerson Ovation OCR400 Controller"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 3.3.1",
                "product": {
                  "name": "Emerson Ovation OCR400 Controller running Ovation: Version 3.3.1 or earlier",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Emerson Ovation OCR400 Controller running Ovation"
          }
        ],
        "category": "vendor",
        "name": "Emerson"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-10967",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A stack-based buffer overflow vulnerability has been identified in the embedded third-party FTP server. The vulnerability involves improper handling of a long file name from the LIST command to the FTP service, which may cause the service to overwrite buffers, leading to remote code execution and escalation of privileges.CVE-2019-10967 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10967"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Emerson is issuing a notice to its customer base with mitigation recommendations, encouraging users with this older software to upgrade to a more current version supported by Emerson and the third-party vendor.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users with installations of the affected versions, Emerson recommends following the instructions outlined in Step 1 and Step 2 (below) to determine whether communication services (including FTP) have been enabled. If communication services have been enabled, Emerson recommends users return FTP services to their default (disabled) state as soon as is practical. If users are unable to make controller changes or disable communication services per the instructions below, they are strongly encouraged to restrict FTP communications to the required database and controller drops only.\u2003Review Ovation Software and Hardware",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Step 1 - Check the Ovation Controller Type",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "In Ovation Developer Studio, right-click on each controller object, select \u201cOpen\u201d and review the \u201cController Type\u201d listed. Alternately, run a System Registration report and verify the \u201cModel\u201d for each controller.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "OCR400: The controller is potentially affected continue with Step 2 (below)",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "OCR161: The controller is not affected by the vulnerabilities detailed in this advisory, and can be disregarded",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Step 2 - Check the Ovation Software Version",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation v3.0.4 and older",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "FTP services cannot be disabled using the Communications Services configuration detailed below. Emerson recommends users of retired systems, including Ovation v3.3.1 and older, consider upgrading to a more current version in which these issues do not exist.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "However, separate mitigation involving network configuration may still be possible. Please refer to the \u201cReview Ovation Highway Switch Configuration\u201d section (below).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation v3.1.0 - v3.3.1",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Follow the \u201cDetermine Current State of Communications Services\u201d (below).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation v3.5.0 and Newer",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "FTP communications services cannot be enabled. This advisory does not apply to those versions.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Determine Current State of Communication Services",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "1.    Ovation Developer Studio",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "2.    Controller Diagnostics application",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Method 1 - Use Ovation Developer Studio to determine the state and modify as needed",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "The steps necessary to review and/or modify communications services settings can be found in Section 5.10.1 of the Developer Studio User Guide for Ovation 3.3.1 (PWS_005981), which is available on the Ovation Users\u0027 Group website: www.ovationusers.com (this website requires registration).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.ovationusers.com"
        },
        {
          "category": "mitigation",
          "details": "Method 2 - Use Controller Diagnostics to determine the state and modify as needed",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "1.    Open the Controller Diagnostic application on an Ovation HMI.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "2.    Select a drop pair by double-clicking on it in the lower-left tree.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "3.    In the upper-left menu, verify the \u201cComm Services\u201d section is set to \u201cDisabled\u201d for both the primary and secondary controllers.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "4.    If \u201cEnabled,\u201d left-click on the object to activate the drop-down menu and select \u201cDisabled.\u201d\u2003Review Ovation Highway Switch Configurations",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Systems using Cisco 2960 and/or 3750 switches on the Ovation Highway may be able to limit FTP communications (as well as telnet, rlogin, and SSH) using access control lists (ACLs). Please refer to the whitepaper \u201cEnabling TELNET, SSH, RLOGIN \u0026 FTP Blocking on Ovation Switches,\u201d which is available at www.ovationusers.com (Support and Security | Security | Network Whitepapers).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.ovationusers.com"
        },
        {
          "category": "mitigation",
          "details": "Ovation Contact Information",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation users with questions or concerns regarding the impact of these vulnerabilities on Ovation should contact the Ovation-CERT via email at OvationCERT@emerson.com or by phone at 1-800-445-9723, Option 3.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "mailto:OvationCERT@emerson.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2019-10965",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A heap-based buffer overflow vulnerability has been identified in the embedded third-party FTP server. The vulnerability involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.CVE-2019-10965 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10965"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Emerson is issuing a notice to its customer base with mitigation recommendations, encouraging users with this older software to upgrade to a more current version supported by Emerson and the third-party vendor.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For users with installations of the affected versions, Emerson recommends following the instructions outlined in Step 1 and Step 2 (below) to determine whether communication services (including FTP) have been enabled. If communication services have been enabled, Emerson recommends users return FTP services to their default (disabled) state as soon as is practical. If users are unable to make controller changes or disable communication services per the instructions below, they are strongly encouraged to restrict FTP communications to the required database and controller drops only.\u2003Review Ovation Software and Hardware",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Step 1 - Check the Ovation Controller Type",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "In Ovation Developer Studio, right-click on each controller object, select \u201cOpen\u201d and review the \u201cController Type\u201d listed. Alternately, run a System Registration report and verify the \u201cModel\u201d for each controller.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "OCR400: The controller is potentially affected continue with Step 2 (below)",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "OCR161: The controller is not affected by the vulnerabilities detailed in this advisory, and can be disregarded",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Step 2 - Check the Ovation Software Version",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation v3.0.4 and older",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "FTP services cannot be disabled using the Communications Services configuration detailed below. Emerson recommends users of retired systems, including Ovation v3.3.1 and older, consider upgrading to a more current version in which these issues do not exist.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "However, separate mitigation involving network configuration may still be possible. Please refer to the \u201cReview Ovation Highway Switch Configuration\u201d section (below).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation v3.1.0 - v3.3.1",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Follow the \u201cDetermine Current State of Communications Services\u201d (below).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation v3.5.0 and Newer",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "FTP communications services cannot be enabled. This advisory does not apply to those versions.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Determine Current State of Communication Services",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "1.    Ovation Developer Studio",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "2.    Controller Diagnostics application",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Method 1 - Use Ovation Developer Studio to determine the state and modify as needed",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "The steps necessary to review and/or modify communications services settings can be found in Section 5.10.1 of the Developer Studio User Guide for Ovation 3.3.1 (PWS_005981), which is available on the Ovation Users\u0027 Group website: www.ovationusers.com (this website requires registration).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.ovationusers.com"
        },
        {
          "category": "mitigation",
          "details": "Method 2 - Use Controller Diagnostics to determine the state and modify as needed",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "1.    Open the Controller Diagnostic application on an Ovation HMI.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "2.    Select a drop pair by double-clicking on it in the lower-left tree.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "3.    In the upper-left menu, verify the \u201cComm Services\u201d section is set to \u201cDisabled\u201d for both the primary and secondary controllers.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "4.    If \u201cEnabled,\u201d left-click on the object to activate the drop-down menu and select \u201cDisabled.\u201d\u2003Review Ovation Highway Switch Configurations",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Systems using Cisco 2960 and/or 3750 switches on the Ovation Highway may be able to limit FTP communications (as well as telnet, rlogin, and SSH) using access control lists (ACLs). Please refer to the whitepaper \u201cEnabling TELNET, SSH, RLOGIN \u0026 FTP Blocking on Ovation Switches,\u201d which is available at www.ovationusers.com (Support and Security | Security | Network Whitepapers).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.ovationusers.com"
        },
        {
          "category": "mitigation",
          "details": "Ovation Contact Information",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ovation users with questions or concerns regarding the impact of these vulnerabilities on Ovation should contact the Ovation-CERT via email at OvationCERT@emerson.com or by phone at 1-800-445-9723, Option 3.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "mailto:OvationCERT@emerson.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}