iniNet SpiderControl PLC Editor Simatic 6.30.04 Insecure File Permissions
Vendor: iniNet Solutions GmbH
Product web page: http://www.spidercontrol.net
Affected version: 6.30.04 (Build 6300400)
Summary: Modular and automated engineering is provided for HMI and
SCADA. The tools are developed to join a large range of engineering
modules together quickly. We modularize our software, as the mechanics
of a system are modularized today. Easy to visualize with a few clicks.
Desc: SpiderControl PLC Editor Simatic suffers from an elevation of
privileges vulnerability which can be used by a simple user that can
change the executable file with a binary of choice. The vulnerability
exist due to the improper permissions, with the 'F' flag (Full) for
'Everyone' group, and 'C' flag (Change) for 'Authenticated Users' group
making the entire directory 'PLCEditorSimatic_6300400' and its files
and sub-dirs world-writable.
Tested on: Microsoft Windows 7 Professional SP1 (EN)
Microsoft Windows 7 Ultimate SP1 (EN)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2015-5283
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5283.php
22.10.2015
--
C:\SpiderControl\PLCEditorSimatic_6300400>cacls PLCEditorSimatic.exe
C:\SpiderControl\PLCEditorSimatic_6300400\PLCEditorSimatic.exe Everyone:(ID)F
BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\SpiderControl\PLCEditorSimatic_6300400>dir
Volume in drive C is Windows
Volume Serial Number is 56F3-8688
Directory of C:\SpiderControl\PLCEditorSimatic_6300400
22/10/2015 10:10 <DIR> .
22/10/2015 10:10 <DIR> ..
09/05/2012 14:03 379 fontconfig.txt
22/10/2015 10:10 <DIR> HTML5Comp
22/10/2015 10:10 <DIR> HWSpecific
24/06/2015 18:42 386,812 IMasterSimatic6_30_04.jar
22/10/2015 10:10 <DIR> ImportNConvertComp
22/10/2015 10:10 <DIR> MacroDlgComp
22/10/2015 10:10 <DIR> MacroDlgRuntime
22/10/2015 10:10 <DIR> MacroLib
22/10/2015 10:10 <DIR> MacroLibTempFiles
26/04/2005 15:26 320 MsgBox.teq
22/10/2015 10:10 <DIR> News_ReleaseNotes
06/06/2012 11:06 81 PLCEditorExtraBatch.bat
11/01/2013 12:29 727 PLCEditorKey.spl
02/07/2015 22:58 7,997,440 PLCEditorSimatic.exe
26/11/2014 19:04 3,806 PLCPPOCheckCfgSimaticPLC.xml
02/07/2015 18:25 2,958,336 PLC_FontGenerator.exe
22/10/2015 10:10 <DIR> Projects
17/06/2015 10:58 34,275 PropWndDescript.xml
25/04/2014 16:55 104,254 s7api.jar
18/05/2015 12:28 42,478 ScadaDescript.xml
10/01/2011 15:09 208 ScadaPPOList.csv
22/10/2015 10:10 <DIR> SCUtils
09/02/2015 13:27 8,242 SimaticDefaultSpiderHWProfile.shp
01/07/2015 16:36 2,693,569 SimaticPLCHelp.chm
22/10/2015 10:30 <DIR> SimulateRuntime
22/10/2015 10:10 <DIR> SimulationComp
06/09/2012 11:13 65,536 SpiderLink1.dll
06/09/2012 11:13 65,536 SpiderLink2.dll
06/09/2012 11:13 65,536 SpiderLink3.dll
06/09/2012 11:13 65,536 SpiderLink4.dll
02/07/2015 18:26 265,216 SpiderObserver.dll
02/07/2015 18:25 269,824 SpiderOPCBrowser.dll
02/07/2015 23:42 483,328 SPSVarSelectorCsv.dll
02/07/2015 18:26 430,080 SPSVarSelectorTpy.dll
22/10/2015 10:10 <DIR> SVGComp
22/10/2015 10:10 86,988 unins000.dat
22/10/2015 10:10 736,929 unins000.exe
10/01/2011 15:05 28 ZelsCfg.csv
22/10/2015 10:10 <DIR> ZipComp
25 File(s) 16,765,464 bytes
16 Dir(s) 77,686,059,008 bytes free
C:\SpiderControl\PLCEditorSimatic_6300400>cd ..
C:\SpiderControl>cacls PLCEditorSimatic_6300400
C:\SpiderControl\PLCEditorSimatic_6300400 Everyone:(OI)(CI)F
BUILTIN\Administrators:(ID)F
BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
NT AUTHORITY\SYSTEM:(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
