-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2293.2
Advisory (icsma-20-184-01) OpenClinic GA
31 August 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: OpenClinic GA
Publisher: ICSMA
Operating System: Network Appliance
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Cross-site Scripting -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Unauthorised Access -- Remote/Unauthenticated
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14494 CVE-2020-14493 CVE-2020-14492
CVE-2020-14491 CVE-2020-14490 CVE-2020-14489
CVE-2020-14488 CVE-2020-14487 CVE-2020-14486
CVE-2020-14485 CVE-2020-14484 CVE-2016-1182
CVE-2016-1181 CVE-2014-0114
Reference: ESB-2020.2293
ESB-2020.1427
ESB-2019.3804
Original Bulletin:
https://www.us-cert.gov/ics/advisories/icsma-20-184-01
Revision History: August 31 2020: 3 additional CVEs added to advisory
July 3 2020: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS Medical Advisory (ICSMA-20-184-01)
OpenClinic GA (Update A)
Original release date: August 27, 2020
Legal Notice
All information products included in https://us-cert.gov/ics are provided"as
is" for informational purposes only. The Department of Homeland Security (DHS)
does not provide any warranties of any kind regarding any information contained
within. DHS does not endorse any commercial product or service, referenced in
this product or otherwise. Further dissemination of this product is governed by
the Traffic Light Protocol (TLP) marking in the header. For more information
about TLP, see https://www.us-cert.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 9.8
o ATTENTION: Exploitable remotely/low skill level to exploit/public exploits
are available
o Vendor: OpenClinic GA is a product of open-source collaboration on Source
Forge
o Equipment: OpenClinic GA
o Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel,
Improper Restriction of Excessive Authentication Attempts, Improper
Authentication, Missing Authorization, Execution with Unnecessary
Privileges, Unrestricted Upload of File with Dangerous Type, Path
Traversal, Improper Authorization, Cross-site Scripting, Use of
Unmaintained Third-Party Components, Insufficiently Protected Credentials,
Hidden Functionality
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled
ICSMA-20-184-01 OpenClinic GA that was published July 2, 2020, on the ICS
webpage on us-cert.gov.
3. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to
bypass authentication, discover restricted information, view/manipulate
restricted database information, and/or execute malicious code.
4. TECHNICAL DETAILS
4.1 AFFECTED PRODUCTS
The following versions of OpenClinic GA, an open-source integrated hospital
information management system, are affected:
o OpenClinic GA Version 5.09.02
o OpenClinic GA Version 5.89.05b
4.2 VULNERABILITY OVERVIEW
4.2.1 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
An attacker may bypass client-side access controls or use a crafted request to
initiate a session with limited functionality, which may allow execution of
admin functions such as SQL queries.
CVE-2020-14485 has been assigned to this vulnerability. A CVSS v3 base score of
9.4 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:L ).
4.2.2 IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307
An attacker can bypass the system's account lockout protection, which may allow
brute force password attacks.
CVE-2020-14484 has been assigned to this vulnerability. A CVSS v3 base score of
7.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:L/I:L/A:L ).
4.2.3 IMPROPER AUTHENTICATION CWE-287
An authentication mechanism within the system does not contain sufficient
complexity to protect against brute force attacks, which may allow unauthorized
users to access the system after no more than a fixed maximum number of
attempts.
CVE-2020-14494 has been assigned to this vulnerability. A CVSS v3 base score of
7.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:L/I:L/A:L ).
4.2.4 MISSING AUTHORIZATION CWE-862
The system does not properly check permissions before executing SQL queries,
which may allow a low-privilege user to access privileged information.
CVE-2020-14491 has been assigned to this vulnerability. A CVSS v3 base score of
8.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:L ).
4.2.5 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
A low-privilege user may use SQL syntax to write arbitrary files to the server,
which may allow the execution of arbitrary commands.
CVE-2020-14493 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).
4.2.6 UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
The system does not properly verify uploaded files, which may allow a
low-privilege user to upload and execute arbitrary files on the system.
CVE-2020-14488 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).
4.2.7 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH
TRAVERSAL') CWE-22
The system includes arbitrary local files specified within its parameter and
executes some files, which may allow disclosure of sensitive files or the
execution of malicious uploaded files.
CVE-2020-14490 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:U/
C:H/I:H/A:H ).
4.2.8 IMPROPER AUTHORIZATION CWE-285
An attacker may bypass permission/authorization checks by ignoring the redirect
of a permission failure, which may allow unauthorized execution of commands.
CVE-2020-14486 has been assigned to this vulnerability. A CVSS v3 base score of
6.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:L/UI:N/S:U/
C:L/I:L/A:L ).
4.2.9 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE
SCRIPTING') CWE-79
The system does not properly neutralize user-controllable input, which may
allow the execution of malicious code within the user's browser.
CVE-2020-14492 has been assigned to this vulnerability. A CVSS v3 base score of
5.4 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:R/S:U/
C:L/I:L/A:N ).
4.2.10 USE OF UNMAINTAINED THIRD-PARTY COMPONENTS CWE-1104
The system contains third-party software versions that are end-of-life and
contain known vulnerabilities, which may allow remote code execution.
- --------- Begin Update A Part 1 of 1 ---------
CVE-2014-0114 , CVE-2016-1181 , and CVE-2016-1182 are related to this
vulnerability.A CVSS v3 base score of 9.8 has been calculated; the CVSS vector
string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ).
- --------- End Update A Part 1 of 1 ---------
4.2.11 INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522
The system stores passwords using inadequate hashing complexity, which may
allow an attacker to recover passwords using known password cracking
techniques.
CVE-2020-14489 has been assigned to this vulnerability. A CVSS v3 base score of
6.2 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
4.2.12 HIDDEN FUNCTIONALITY CWE-912
The system contains a hidden default user account that may be accessed if an
administrator has not expressly turned off this account, which may allow an
attacker to login and execute arbitrary commands.
Does not affect Version 5.89.05b.
CVE-2020-14487 has been assigned to this vulnerability. A CVSS v3 base score of
9.4 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:L ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Open-source
3.4 RESEARCHER
Brian D. Hysell reported these vulnerabilities to CISA.
4. MITIGATIONS
OpenClinic GA is aware of these vulnerabilities but has not provided any
confirmation of their resolution. Please upgrade to the latest version to
ensure you have all current fixes.
CISA recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:
o Ensure that least-privilege user principle is followed.
o Minimize network exposure for all control system devices and/or systems,
and ensure that they are not accessible from the Internet .
o Locate control system networks and remote devices behind firewalls, and
isolate them from the business network.
o When remote access is required, use secure methods, such as Virtual Private
Networks (VPNs), recognizing that VPNs may have vulnerabilities and should
be updated to the most current version available. Also recognize that VPN
is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves
from social engineering attacks:
o Do not click web links or open unsolicited attachments in email messages.
o Refer to Recognizing and Avoiding Email Scams for more information on
avoiding email scams.
o Refer to Avoiding Social Engineering and Phishing Attacks for more
information on social engineering attacks.
For any questions related to this report, please contact the CISA at:
Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870
CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX0yQJeNLKJtyKPYoAQh8ag/+Ni8TXgr1w61iYYTqVbsuEnZMJWbyoAT7
HSJceOEpP3SBYfyrOpO3hl9OJ5U2fG/Kow3lUEgnk7LjQJ9hGDz7OF/vxtw2nC8M
v44eSzF+6kjotQMtHqwIE5D7ByxF+S++bTjWxNt+eq5o5kiDE80LNsNgaTKEl99m
q5Ed5iDSJ0fphf8EmaB9pzGqIt24ofN3TZCnCYvRtyAfdtZNPwuA4dC34ANl2jOm
VTIz6H+rz9RNECWtrlLtOFJ1s4M88aWf2igJOSAK1hCphZwS4T03qIgz38sItZJt
L7EoP6o4bCw8Mzl2HTq58i03TL9aBEV2kERAGQku/Op3Lj5B+IEordlOWa6RQgQ/
lep+6CyOC74qAJs9smD6eYphZ2lKeOXtR2kpzVDWA75GFCeoPrrqwFK6tNewwxxz
JjVaVGQpo7GtfxHh2C+S5Y0IEscScfep+Krz5VN2JM3s0H+ZXdCMQ9nNW97yxL1+
G2+9Ll0WK8NkZFFU0RAKU7vYsaXmeHQPEHnonyT3Q5pa998ZsSP9MntspdQwkyVG
pEeLZwdXDQ5lAIqKZK99Ah4BEFTk91Li2O6RWVDq1xWai+Ig9EwodxCp/EwVcniq
RWW2QeKmO3DkvGIfhOK79wYpAETgDkpDpzPsKfziUgx42oi0xAts1zCq7g6cOruj
OxuZBe7PQtI=
=4KOm
-----END PGP SIGNATURE-----
Read More
The post ESB-2020.2293.2 - UPDATE [Appliance] OpenClinic GA: Multiple vulnerabilities first appeared on Malware Devil.
https://www.malwaredevil.com/2020/08/31/esb-2020-2293-2-update-appliance-openclinic-ga-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-2293-2-update-appliance-openclinic-ga-multiple-vulnerabilities
