SB2022090101 - Multiple vulnerabilities in Hitachi Energy FACTS Control Platform (FCP)

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Raccoon attack (CVE-ID: CVE-2020-1968)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a timing flaw in the TLS specification. A remote attacker can compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite and eavesdrop on all encrypted communications sent over that TLS connection.

Note: The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections.

2) Improper Authorization (CVE-ID: CVE-2020-8172)

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to TLS session reuse and host certificate verification bypass, as the 'session' event can be emitted before the 'secureConnect' event in Node.js. The application agent performs https session caching and an unauthorized connection can be established via the cached session ticket and treated as authorized connection.

3) Buffer overflow (CVE-ID: CVE-2020-8174)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16() functions. A remote attacker can create a specially crafted data to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2020-8201)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

5) Buffer overflow (CVE-ID: CVE-2020-8252)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to incorrect validation of realpath in libuv. The library incorrectly determines the buffer size, which can result in a buffer overflow if the resolved path is longer than 256 bytes. A remote attacker can pass an overly long path to the application that is using the library, trigger memory corruption and execute arbitrary code on the system.

6) Use-after-free (CVE-ID: CVE-2020-8265)

The vulnerability allows a remote attacker to perform a DoS attack..

The vulnerability exists due to a use-after-free error in TLSWrap within the TLS implementation. A remote attacker can send specially crafted data to the service and perform a denial of service (DoS) attack.

7) HTTP request smuggling (CVE-ID: CVE-2020-8287)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://ics-cert.us-cert.gov/advisories/icsa-22-242-01