Most recent entries from csaf_siemens

SSA-625789 — SSA-625789: Multiple Vulnerabilities in SIMATIC S7-1200 CPU V1/V2 Devices

Fri, 10 Jun 2011 00:00:00 +0000

The web server interface of affected devices improperly processes incoming malformed HTTP traffic at high rate. This could allow an unauthenticated remote attacker to force the device entering the stop/defect state, thus creating a denial of service condition. Affected controllers are vulnerable to capture-replay in the communication with the engineering software. This could allow an on-path attacker between the engineering software and the controller to execute any previously recorded commands at a later time (e.g. set the controller to STOP), regardless whether or not the controller had a password configured.

SSA-130874 — SSA-130874: Buffer Overflow Vulnerability in SCALANCE X Switches

Thu, 05 Apr 2012 00:00:00 +0000

The embedded web server on affected devices contains a buffer overflow vulnerability. This could allow remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.

SSA-240718 — SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V2

Thu, 13 Sep 2012 00:00:00 +0000

Affected devices do not properly protect the private key of the integrated Certification Authority (CA) certificate. Possession of this key could allow remote attackers to spoof the device's web server by creating a forged web server certificate.

SSA-279823 — SSA-279823: Cross-Site Scripting Vulnerability in SIMATIC S7-1200 CPU V2/V3 Before V3.0.2

Mon, 08 Oct 2012 00:00:00 +0000

The web server on affected devices contains a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary web script or HTML via a crafted URI.

SSA-783261 — SSA-783261: Denial of Service Vulnerability in Automation License Manager (ALM) Before V5.2

Wed, 12 Dec 2012 00:00:00 +0000

Specially crafted packets sent to port 4410/tcp cause memory leaks within the application. This could allow a remote unauthenticated attacker to crash the application due to insufficient resources. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification.

SSA-373591 — SSA-373591: Buffer Overflow Vulnerability in RUGGEDCOM ROS Devices

Tue, 13 Jul 2021 00:00:00 +0000

The DHCP client in affected devices fails to properly sanitize incoming DHCP packets. This could allow an unauthenticated remote attacker to cause memory to be overwritten, potentially allowing remote code execution.

SSA-599968 — SSA-599968: Denial of Service Vulnerability in Profinet Devices

Tue, 13 Jul 2021 00:00:00 +0000

Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered if a large amount of DCP reset packets are sent to the device.

SSA-913875 — SSA-913875: Frame Aggregation and Fragmentation Vulnerabilities in 802.11

Tue, 13 Jul 2021 00:00:00 +0000

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets. An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients. An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration. An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol. An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragme…

SSA-244969 — SSA-244969: OpenSSL Vulnerability in Industrial Products

Tue, 08 Feb 2022 00:00:00 +0000

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the applicati…

SSA-306654 — SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products

Tue, 22 Feb 2022 00:00:00 +0000

Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities.

Siemens has released new versions for the affected products and recommends to update to the latest versions.