SSA-455843

csafDEsiemens_psirt

SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products

view advisory published 2020-09-08

CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and CVE-2020-16233. Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, attain remote code execution, or prevent normal operation of the Siemens software that depends on CodeMeter Runtime. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

01

describes (6)

Related CVEs.

IDseverity exploitable
CVE-2020-16233UShigh7.5—
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap.
CVE-2020-14519UShigh7.5—
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected We…
CVE-2020-14517UScritical9.8OT elevated—
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and…
CVE-2020-14515UShigh7.5—
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows…
CVE-2020-14513UShigh7.5—
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields.
CVE-2020-14509UScritical9.8—
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send s…
02

references

External citations — patches, advisories, analysis.

03

remediations (90)

  • MitigationPSS CAPE Protection Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationPSS CAPE Protection Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationPSS CAPE Protection Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationPSS CAPE Protection Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationPSS CAPE Protection Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationPSS CAPE Protection Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSICAM 230

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Information Server 2019

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Information Server 2019

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Information Server 2019

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Information Server 2019

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neo

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neo

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neo

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neo

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neo

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC PCS neo

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC WinCC OA

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC WinCC OA

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC WinCC OA

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMATIC WinCC OA

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSIMIT Simulation Platform

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEC INS

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEC INS

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEC INS

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEC INS

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEMA Remote Connect

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEMA Remote Connect

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • MitigationSINEMA Remote Connect

    All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.

  • No fix plannedSICAM 230

    Currently no remediation is planned

  • No fix plannedSICAM 230

    Currently no remediation is planned

  • No fix plannedSICAM 230

    Currently no remediation is planned

  • No fix plannedSICAM 230

    Currently no remediation is planned

  • No fix plannedSICAM 230

    Currently no remediation is planned

  • No fix plannedSICAM 230

    Currently no remediation is planned

  • FixedPSS CAPE Protection Simulation Platform

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedPSS CAPE Protection Simulation Platform

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedPSS CAPE Protection Simulation Platform

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedPSS CAPE Protection Simulation Platform

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedPSS CAPE Protection Simulation Platform

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedPSS CAPE Protection Simulation Platform

    CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime

  • FixedSIMATIC Information Server 2019

    Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Information Server 2019

    Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Information Server 2019

    Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Information Server 2019

    Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC PCS neo

    Update to V3.0 SP1 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)

    Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1

    https://support.industry.siemens.com/cs/ww/en/view/109784449/
  • FixedSIMATIC WinCC OA

    Update to V3.17 P007 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMATIC WinCC OA

    Update to V3.17 P007 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMATIC WinCC OA

    Update to V3.17 P007 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMATIC WinCC OA

    Update to V3.17 P007 or later version

    https://www.winccoa.com/downloads/category/versions-patches.html
  • FixedSIMIT Simulation Platform

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSIMIT Simulation Platform

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSIMIT Simulation Platform

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSIMIT Simulation Platform

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSIMIT Simulation Platform

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSIMIT Simulation Platform

    Update to V10.2 Upd1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109794248/
  • FixedSINEC INS

    Update to V1.0 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793469/
  • FixedSINEC INS

    Update to V1.0 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793469/
  • FixedSINEC INS

    Update to V1.0 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793469/
  • FixedSINEC INS

    Update to V1.0 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793469/
  • FixedSINEMA Remote Connect

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793790/
  • FixedSINEMA Remote Connect

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793790/
  • FixedSINEMA Remote Connect

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793790/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan