SSA-618620: Vulnerabilities in Boot Loader (U-Boot) of RUGGEDCOM ROS Devices
The boot loader within RUGGEDCOM ROS contains two vulnerabilities in the loading process of the operating system kernel. The more severe of these vulnerabilities could allow an attacker with local access to the device to execute arbitrary code on an affected device. Siemens recommends specific countermeasures to mitigate this issue.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-13103US | high7.1 | — | ||
A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually eit… | ||||
| CVE-2018-18440US | high7.8 | — | ||
DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled. | ||||
references
External citations — patches, advisories, analysis.
- SSA-618620: Vulnerabilities in Boot Loader (U-Boot) of RUGGEDCOM ROS Devices - CSAF Versionself
- SSA-618620: Vulnerabilities in Boot Loader (U-Boot) of RUGGEDCOM ROS Devices - HTML Versionself
- SSA-618620: Vulnerabilities in Boot Loader (U-Boot) of RUGGEDCOM ROS Devices - PDF Versionself
- SSA-618620: Vulnerabilities in Boot Loader (U-Boot) of RUGGEDCOM ROS Devices - TXT Versionself
remediations (69)
- MitigationRUGGEDCOM RMC8388 V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RMC8388 V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RMC8388NC V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RMC8388NC V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488 V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488 V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488 V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488 V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488NC V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488NC V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488NC V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG2488NC V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG907R
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG908C
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG909R
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG910C
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920P V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920P V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920P V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920P V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920PNC V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920PNC V4.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920PNC V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSG920PNC V5.X
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSL910
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RSL910NC
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RST2228
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RST2228
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RST2228P
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RST2228P
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RST916C
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- MitigationRUGGEDCOM RST916P
Disable access to the removable media via 'bootoption.txt' file parameter 'Disableautoaccessremovable = Yes' to mitigate CVE-2019-13103. Note that this vulnerability only applies to RUGGEDCOM ROS, if the device boots from removable media.
- No fix plannedRUGGEDCOM RMC8388 V4.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RMC8388NC V5.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG2488 V4.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG2488 V4.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG2488 V5.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG2488 V5.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG2488NC V4.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG2488NC V5.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG907R
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG908C
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG909R
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG910C
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG920P V4.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG920P V4.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG920P V5.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG920P V5.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG920PNC V4.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSG920PNC V5.X
Currently no fix is planned
- No fix plannedRUGGEDCOM RSL910
Currently no fix is planned
- No fix plannedRUGGEDCOM RSL910NC
Currently no fix is planned
- No fix plannedRUGGEDCOM RST2228
Currently no fix is planned
- No fix plannedRUGGEDCOM RST2228
Currently no fix is planned
- No fix plannedRUGGEDCOM RST2228P
Currently no fix is planned
- No fix plannedRUGGEDCOM RST916C
Currently no fix is planned
- No fix plannedRUGGEDCOM RST916P
Currently no fix is planned
- No fix availableRUGGEDCOM RMC8388 V5.X
Currently no fix is available
- No fix availableRUGGEDCOM RMC8388NC V4.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG2488NC V4.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG2488NC V4.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG2488NC V5.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG2488NC V5.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG920PNC V4.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG920PNC V4.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG920PNC V5.X
Currently no fix is available
- No fix availableRUGGEDCOM RSG920PNC V5.X
Currently no fix is available
- No fix availableRUGGEDCOM RST2228P
Currently no fix is available
- No fix availableRUGGEDCOM RST2228P
Currently no fix is available
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan