Siemens patches Heartbleed in popular SCADA system

Some of the company's other products are still vulnerable

Siemens released a security update to address the Heartbleed vulnerability in SIMATIC WinCC Open Architecture, a supervisory control and data acquisition (SCADA) system that's used in a large number of industries to operate processes, machines and production flows.

Heartbleed is a critical security flaw discovered earlier this month in OpenSSL, the most popular implementation of the TLS (Transport Layer Security) and SSL (Secure Sockets Layer) protocols.

The vulnerability can be exploited to extract passwords, encryption keys and other potentially sensitive information from the memory of TLS servers and clients that rely on OpenSSL for encrypted communications. While most of the discussion surrounding the vulnerability has focused on how it impacts Web servers, the flaw also affects desktop and mobile applications, embedded systems like routers, hardware appliances and industrial control systems, including those potentially used in critical infrastructure.

Siemens updated its Heartbleed security advisory Friday to announce the availability of WinCC OA version 3.12-P006 that fixes the flaw for WinCC OA 3.12, the only affected version of the product according to the company.

However, Heartbleed also affects other Siemens products: eLAN prior to version 8.3.3 when RIP is used, S7-1500 V1.5 when HTTPS is active, CP1543-1 V1.1 when FTPS is active and APE 2.0 when the SSL/TLS component is used in customer implementations.

ELAN customers can solve the security issue by updating to version 8.3.3, but the other affected products are yet to receive patches. In the meantime, Siemens suggests several mitigations in its security advisory that involve disabling or restricting access to the web server in S7-1500 and disabling or restricting access to FTPS in CP1543-1.

APE 2.0 customers can upgrade the OpenSSL installation in the product to version 1.0.1g by following instructions in a separate advisory published on the RuggedCom website. RuggedCom is a subsidiary of Siemens and the original maker of the product.

Join the newsletter!

Or
Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitypatch managementsiemenspatchesExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Mobile

Exec

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?