PHOENIX CONTACT: Vulnerabilities in XML parser library Expat (libexpat)
Several vulnerabilities have been discovered in the Expat XML parser library (aka libexpat).This open-source component is widely used in a lot of products worldwide.A remote, anonymous attacker could use an integer overflow to execute arbitrary program code when loading specially crafted XML files. Profinet SDK is using XML parser library Expat as reference solution for loading the XML based Profinet network configuration files (IPPNIO or TIC).
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-25315US | critical9.8 | Exploit | ||
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | ||||
| CVE-2022-25314US | high7.5 | Exploit | ||
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | ||||
| CVE-2022-25313US | medium6.5 | Exploit | ||
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | ||||
| CVE-2022-25236US | critical9.8 | Exploit | ||
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | ||||
| CVE-2022-25235US | critical9.8 | Exploit | ||
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. | ||||
| CVE-2022-23990US | high7.5 | Exploit | ||
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. | ||||
| CVE-2022-23852US | critical9.8 | Exploit | ||
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. | ||||
| CVE-2022-22827US | high8.8 | — | ||
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | ||||
| CVE-2022-22826US | high8.8 | — | ||
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | ||||
| CVE-2022-22825US | high8.8 | — | ||
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | ||||
| CVE-2022-22824US | critical9.8 | — | ||
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | ||||
| CVE-2022-22823US | critical9.8 | — | ||
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | ||||
| CVE-2022-22822US | critical9.8 | Exploit | ||
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | ||||
| CVE-2021-46143US | high7.8 | Exploit | ||
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. | ||||
| CVE-2021-45960US | high8.8 | Exploit | ||
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, o… | ||||
references
External citations — patches, advisories, analysis.
remediations (30)
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- MitigationPROFINET SDK
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- FixedPROFINET SDK
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan