SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products
WIBU Systems published information about a denial-of-service vulnerability and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerability is described in the section "Vulnerability Classification" below and got assigned the CVE ID CVE-2021-41057. Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server (i.e., CodeMeter.exe), which could cause a denial-of-service condition for the affected Siemens product. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-41057US | high7.1 | — | ||
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. | ||||
references
External citations — patches, advisories, analysis.
- SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products - CSAF Versionself
- SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products - PDF Versionself
- SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products - TXT Versionself
remediations (17)
- MitigationSIMATIC Information Server
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC PCS neo
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC Process Historian (incl. Process Historian OPC UA Server)
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC WinCC OA V3.17
Limit local access to the WinCC OA server by hardening measures according to the security guideline.
- MitigationSIMATIC WinCC OA V3.18
Limit local access to the WinCC OA server by hardening measures according to the security guideline.
- No fix plannedSICAM 230
Currently no fix is planned
- FixedPSS(R)CAPE
CAPE 14 installations installed from material dated 2021-10-05 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- FixedPSS(R)E V34
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - FixedPSS(R)E V35
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - FixedPSS(R)ODMS V12
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - FixedSICAM 230
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_2: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_S VA_2021_2.pdf.
- FixedSIMATIC Information Server
To update, use the Information Server version as bundled with PCS neo V3.1 Upd1 (https://support.industry.siemens.com/cs/ww/en/view/109804750/) or with PCS 7 V9.1 SP1 (https://support.industry.siemens.com/cs/ww/en/view/109805073/)
- FixedSIMATIC PCS neo
Update to V3.1 Upd 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109804750/ - FixedSIMATIC Process Historian (incl. Process Historian OPC UA Server)
To update, use the Process Historian version as bundled with PCS neo V3.1 Upd1 (https://support.industry.siemens.com/cs/ww/en/view/109804750/) or with PCS 7 V9.1 SP1 (https://support.industry.siemens.com/cs/ww/en/view/109805073/)
- FixedSIMATIC WinCC OA V3.17
Update to V3.17 P015 or later version
https://www.winccoa.com/downloads/category/versions- patches.html - FixedSIMATIC WinCC OA V3.18
Update to V3.18 P005 or later version
https://www.winccoa.com/downloads/category/versions- patches.html - FixedSIMIT Simulation Platform
Update to V11.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810223/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan