SSA-400332

csafDEsiemens_psirt

SSA-400332: Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Questa and ModelSim

view advisory published 2021-12-14

A security research [1] identified weaknesses in the IEEE 1735 recommended practice for encryption of Design IP, which could allow a sophisticated attacker access to unencrypted Design IP data in IEEE 1735-compliant products. This advisory addresses the specific details for the affected Siemens software products: Questa and ModelSim simulators. Siemens is preparing updates and recommends specific countermeasures for Questa and ModelSim. [1] https://arxiv.org/abs/2112.04838

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2021-42023USmedium6.5Exploit
A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected applications insufficientl…
02

references

External citations — patches, advisories, analysis.

03

remediations (4)

  • MitigationModelSim Simulation

    Companies that deliver encrypted design IP data to their customers: ensure that procedural and contractual measures are in place that minimize the risk of unauthorized access to the data.

  • MitigationQuesta Simulation

    Companies that deliver encrypted design IP data to their customers: ensure that procedural and contractual measures are in place that minimize the risk of unauthorized access to the data.

  • FixedModelSim Simulation

    Update to new releases as they become available (see also section Additional Information)

    https://support.sw.siemens.com/en-US/product/852852093/
  • FixedQuesta Simulation

    Update to new releases as they become available (see also section Additional Information)

    https://support.sw.siemens.com/en-US/product/852852103/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan