SSA-788287: Disclosure of Private Data
Due to SmartClient Installation technology (ClickOnce) a customer/integrator needs to create a customer specific Smartclient installer. The mentioned products delivered a trusted but yet expired codesigning certificate. An attacker could have exploited the vulnerability by spoofing the code-signing certificate and signing a malicious executable resulting in having a trusted digital signature from a trusted provider. The certificate was revoked immediately.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-27389US | critical9.8OT elevated | — | ||
A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequ… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- MitigationOpcenter Quality
Explicitly distrust the certificate with the fingerprint FA:53:A4:74:FC:1E:16:6F:E6:6A:D2:5A:C1:E6: 8B:B1:91:CB:38:E9:85:7E:07:79:C1:A5:C3:59:1A:5A:04:96
- MitigationQMS Automotive
Explicitly distrust the certificate with the fingerprint FA:53:A4:74:FC:1E:16:6F:E6:6A:D2:5A:C1:E6: 8B:B1:91:CB:38:E9:85:7E:07:79:C1:A5:C3:59:1A:5A:04:96
- No fix availableOpcenter Quality
Currently no remediation is available
- No fix availableQMS Automotive
Currently no remediation is available
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan