Siemens Products affected by OpenSSL 3.0
The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.openssl.org/news/secadv/20221101.txt
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3786US | high7.5 | Exploit | ||
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification… | ||||
| CVE-2022-3602US | high7.5 | Exploit | ||
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification… | ||||
references
External citations — patches, advisories, analysis.
- SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products - CSAF Versionself
- SSA-408105: Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products - HTML Versionself
- ICS Advisory ICSA-22-349-09 JSONself
- ICS Advisory ICSA-22-349-09 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (36)
- MitigationCalibre ICE
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationCalibre ICE
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationMcenter
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationMcenter
As a mitigation for vulnerable versions: Ensure that only trusted (CA) certificates are contained in the Machine Agent's truststore
- MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPass
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSICAM GridPass
As a mitigation for vulnerable versions: In the truststore, do not add CA certificates that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Manager
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- MitigationSIMATIC RTLS Locating Manager
Siemens products that contain a vulnerable TLS client: in cases where this option is configurable: ensure that TLS server certificate verification is turned on and do not configure trust for CA certificates, that contain a nameConstraint-extension (https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10) with punycode-encoded internationalized domain names
- FixedCalibre ICE
Update to V2023.1 or later version
- FixedCalibre ICE
Update to V2023.1 or later version
- FixedMcenter
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - FixedMcenter
Update to V5.3.0 or later version
https://download.industrysoftware.automation.siemens.com/ - FixedSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)
Update to V3.2.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995126/ - FixedSICAM GridPass
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - FixedSICAM GridPass
Update to V2.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - FixedSIMATIC RTLS Locating Manager
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/ - FixedSIMATIC RTLS Locating Manager
Update to V2.13.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821005/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan