The bad news: the vulnerability of high-profile web sites are just the tip of the iceberg or – more accurately – the head in front of a very long tail of vulnerable web sites and applications. Many of those applications and sites are among the systems that support critical infrastructure. For evidence of that, look no further than the alert issued Thursday by the Department of Homeland Security’s Industrial Control System (ICS) Computer Emergency Readiness Team (CERT). The alert – an update to one issued last month – includes a list of 43 ICS applications that are known to be vulnerable to Heartbleed. (http://ics-cert.us-cert.gov/advisories/ICSA-14-135-05) Just over half have patches available for the Heartbleed flaw, according to ICS CERT data. But that leaves twenty applications vulnerable, including industrial control products from major vendors like Siemens, Honeywell and Schneider Electric.
Even when patches are available, many affected organizations — including operators of critical infrastructure — may have a difficult time applying the patch. ICS environments are notoriously difficult to audit because ICS devices often respond poorly to any form of scanning. ICS-CERT notes that both active- and passive vulnerability scans are “dangerous when used in an ICS environment due to the sensitive nature of these devices.” Specifically: “when it is possible to scan the device, it is possible that device could be put into invalid state causing unexpected results and possible failure of safety safeguards,” ICS-CERT warned.
Link to Original Source