Siemens Parasolid
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3786US | high7.5 | Exploit | ||
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification… | ||||
| CVE-2022-3602US | high7.5 | Exploit | ||
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification… | ||||
references
External citations — patches, advisories, analysis.
- SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products - CSAF Versionself
- SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products - HTML Versionself
- SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products - PDF Versionself
- SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products - TXT Versionself
- ICS Advisory ICSA-22-349-12 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-349-12 - Web Versionself
- Recommended Practicesexternal
remediations (20)
- MitigationCalibre ICE
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationCalibre ICE
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationMcenter
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationMcenter
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationSCALANCE X-200RNA switch family
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X-200RNA switch family
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPass (6MD7711-2AA00-1EA0)
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension ( https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPass (6MD7711-2AA00-1EA0)
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension ( https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Manager
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Manager
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- No fix availableSCALANCE X-200RNA switch family
Currently no fix is available
- No fix availableSCALANCE X-200RNA switch family
Currently no fix is available
- FixedCalibre ICE
Update to V2023.1 or later version
https://support.sw.siemens.com/ - FixedCalibre ICE
Update to V2023.1 or later version
https://support.sw.siemens.com/ - FixedMcenter
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - FixedMcenter
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - FixedSICAM GridPass (6MD7711-2AA00-1EA0)
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - FixedSICAM GridPass (6MD7711-2AA00-1EA0)
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - FixedSIMATIC RTLS Locating Manager
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/ - FixedSIMATIC RTLS Locating Manager
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan