CVE-2014-5413: Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues

Published Sep 18, 2014

Updated

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm.

Affected Software

9 affected components

AVEVA Clearscada=2010-r3

AVEVA Clearscada=2010-r3.1

AVEVA Clearscada=2013-r1

AVEVA Clearscada=2013-r1.1

AVEVA Clearscada=2013-r1.1a

AVEVA Clearscada=2013-r1.2

AVEVA Clearscada=2013-r2

Schneider-electric Scada Expert Clearscada=2013-r2.1

Schneider-electric Scada Expert Clearscada=2014-r1

Remediation

Information

Asset owners should always obtain a signed web certificate from a certified authority before deploying ClearSCADA Web Server in a production environment. To assist asset owners who are currently using self-signed certificates, a standalone utility will be made available that can be used to generate and deploy a new self-signed certificate (signed using an SHA signing algorithm). This utility is recommended for existing ClearSCADA systems subject to this vulnerability, removing the need to upgrade the ClearSCADA software and perform a manual generation of a new certificate. This utility will be made available within the Software Downloads section of the following ClearSCADA Resource Center page: http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support

Event History

Sep 18, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:55 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-5413?

CVE-2014-5413 is rated as a high severity vulnerability due to its potential to allow remote attackers to spoof servers.

How do I fix CVE-2014-5413?

To fix CVE-2014-5413, it is recommended to upgrade to a version of ClearSCADA that does not use the MD5 algorithm for X.509 certificates.

What systems are affected by CVE-2014-5413?

CVE-2014-5413 affects Schneider Electric StruxureWare SCADA Expert ClearSCADA versions from 2010 R3 to 2014 R1.

What type of attack does CVE-2014-5413 allow?

CVE-2014-5413 allows attackers to perform cryptographic attacks that can lead to server spoofing.

Is CVE-2014-5413 related to MD5 vulnerabilities?

Yes, CVE-2014-5413 is specifically problematic due to the use of the MD5 algorithm, which is known to be weak.