How to remediate – 7-Technologies / Schneider-Electric IGSS ODBC Service Detection

1. Introduction

The 7-Technologies / Schneider-Electric IGSS ODBC Service Detection vulnerability indicates that an Interactive Graphical SCADA System (IGSS) service is running on a Windows host. This can present a risk as the IGSS system, and its components like the ODBC interface, may be vulnerable to exploitation. Affected systems are typically industrial control systems (ICS) or supervisory control and data acquisition (SCADA) environments. A successful exploit could lead to loss of confidentiality, integrity, and availability of the SCADA system.

2. Technical Explanation

The vulnerability occurs when the IGSS ODBC service (Odbcixvse.exe) is running on a Windows host. This component allows other applications to access data from the IGSS database. An attacker could potentially exploit vulnerabilities within this ODBC interface to gain unauthorized access or control of the SCADA system. There are no known CVEs associated with this detection itself, but the underlying IGSS software may have associated vulnerabilities. For example, an attacker might use a crafted query through the ODBC connection to execute arbitrary code on the host.

• Root cause: The presence of the IGSS ODBC service provides an attack surface for potential exploitation.
• Exploit mechanism: An attacker could send malicious SQL queries or commands via the ODBC interface, potentially leading to remote code execution or data theft.
• Scope: Windows hosts running 7-Technologies / Schneider-Electric Interactive Graphical SCADA System (IGSS) software with the ODBC service enabled are affected. Specific versions may be more vulnerable than others; consult vendor documentation for details.

3. Detection and Assessment

To confirm if a system is vulnerable, you can check for the running IGSS ODBC service. A quick check involves listing processes, while a thorough method includes examining file properties.

• Quick checks: Use Task Manager or PowerShell to list running processes and identify Odbcixvse.exe. For example in PowerShell: Get-Process | Where-Object {$_.ProcessName -like "Odbcixv*.exe"}
• Scanning: Nessus plugin ID 138479 may detect the presence of IGSS, but this is an example only and should be verified.
• Logs and evidence: Check Windows Event Logs for events related to Odbcixvse.exe or IGSS activity.

Get-Process | Where-Object {$_.ProcessName -like "Odbcixv*.exe"}

4. Solution / Remediation Steps

The primary solution is to disable or remove the IGSS ODBC service if it’s not required. If needed, ensure the IGSS software is updated to the latest version with security patches applied.

4.1 Preparation

• Dependencies: Identify applications or systems using the IGSS ODBC service. A roll back plan involves restoring from backup or re-enabling the service.
• Change window needs and approval may be required due to potential impact on ICS/SCADA operations.

4.2 Implementation

1. Step 1: Open the Services application (services.msc).
2. Step 2: Locate the “Schneider Electric IGSS ODBC Service” or similar entry.
3. Step 3: Right-click on the service and select “Properties”.
4. Step 4: Change the “Startup type” to “Disabled”.
5. Step 5: Click “Apply” and then “OK”.

4.3 Config or Code Example

Before

Startup type: Automatic

After

Startup type: Disabled

4.4 Security Practices Relevant to This Vulnerability

• Least privilege: Limit access to the IGSS system and its components to only authorized users and applications.
• Safe defaults: Ensure that all services are configured with secure default settings, including disabling unnecessary features like ODBC if not required.

4.5 Automation (Optional)

# PowerShell example to disable the service
Set-Service -Name "Schneider Electric IGSS ODBC Service" -StartupType Disabled

5. Verification / Validation

To confirm the fix, verify that the IGSS ODBC service is disabled and no longer running. Perform a smoke test of any dependent applications to ensure functionality remains intact.

• Post-fix check: Run Get-Service -Name "Schneider Electric IGSS ODBC Service" in PowerShell. Expected output should show ‘Status’ as Stopped and ‘StartupType’ as Disabled.
• Re-test: Re-run the initial process listing command (Get-Process | Where-Object {$_.ProcessName -like "Odbcixv*.exe"}) to confirm that Odbcixvse.exe is no longer running.
• Smoke test: Verify that any applications relying on IGSS data are still functioning correctly.
• Monitoring: Monitor Windows Event Logs for unexpected errors related to IGSS or ODBC activity.

Get-Service -Name "Schneider Electric IGSS ODBC Service"

6. Preventive Measures and Monitoring

• Baselines: Update security baselines to include disabling unnecessary services like the IGSS ODBC service where possible.
• Pipelines: Implement configuration management tools to enforce desired service states and prevent unauthorized changes.
• Asset and patch process: Establish a regular patch review cycle for all ICS/SCADA components, including IGSS software.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Disabling the ODBC service may break functionality in applications that rely on it.
• Risk or side effect 2: Incorrectly disabling services can cause system instability.
• Roll back: Step 1: Open Services (services.msc). Step 2: Locate the IGSS ODBC Service. Step 3: Change Startup type to Automatic. Step 4: Start the service if needed.

8. References and Resources

• Vendor advisory or bulletin: http://igss.schneider-electric.com/products/igss/index.aspx