ICS-CERT: Siemens COMOS Privilege Escalation Vulnerability

Thursday, August 16, 2012

Infosec Island Admin


Siemens has reported a privilege escalation vulnerability in the Siemens COMOS database application. Siemens has produced an update that fixes this vulnerability. This vulnerability could be exploited remotely.

Siemens reports that the vulnerability affects the following versions of COMOS:

• All versions earlier than Version 9.1
• Version 9.1: Patch 412 and earlier
• Version 9.2: Update 3 Patch 022 and earlier
• Version 10: Patch 004 and earlier


Authenticated users with read privileges could escalate their privileges by exploiting this vulnerability. Thus, the attacker is able to gain administrator access to the database.
Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.


Siemens COMOS is an object oriented database system that supports collecting, processing, saving, and distributing of information through a design process. It allows the configuration of different user privileges to different users.


PRIVILEGE ESCALATION:  Authenticated users with read privileges could escalate their privileges by exploiting a documented method in the design of the database. As a result, the attacker gains administrator access to the database. CVE-2012-3009 has been assigned to this vulnerability. A CVSS v2 base score of 8.5 has been assigned; the CVSS vector string is (AV:N/AC:M/Au:S/C:C/I:C/A:C).

EXPLOITABILITY:  This vulnerability could be exploited remotely.

EXISTENCE OF EXPLOIT:  No known public exploits specifically target this vulnerability.

DIFFICULTY:  An attacker with a medium skill level could exploit these vulnerabilities.


For COMOS Versions 9.1, 9.2, and 10.0, Siemens recommends installing the corresponding patches as soon as possible:

• Version 9.1 Patch 413

• Version 9.2 Update 03 Patch 023

• Version V10 Patch 005.

These software updates are available at Siemens customer support. earlier versions, Siemens recommends upgrading to a newer version.

The full ICS-CERT advisory can be found here:

Source:  http://www.us-cert.gov/control_systems/pdf/ICSA-12-227-01.pdf

Possibly Related Articles:
Industrial Control Systems
SCADA Authentication Access Control Vulnerabilities Siemens Privilege Escalation ICS-CERT Industrial Control Systems COMOS
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.