WAGO: WIBU-SYSTEMS CodeMeter Runtime vulnerabilities in multiple products
A heap-based buffer overflow caused by libcurl and wrong whitespace character interpretation in Javascript, both used in CodeMeter Runtime affecting multiple products by WAGO. WIBU-SYSTEMS Codemeter is installed by default during e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) installations.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-38545US | critical9.8 | Exploit | ||
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
that to resolve the ad… | ||||
| CVE-2023-24540US | critical9.8 | — | ||
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029"… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Disable using a SOCKS5 proxy: The proxy environment variables HTTP_PROXY, HTTPS_PROXY and ALL_PROXY must not be set to socks5h:// Ensure that CodeMeter is not defined to use the SOCKS5 proxy. The variable ProxyServer must not be start with socks5h://. On Windows, the definition of that variable is in the registry (regedit) under HKLM/SOFTWARE/WIBU-SYSTEMS/CodeMeter/Server/CurrentVersion On Mac, the definition of that variable is in the file /Library/Preferences/com.wibu.CodeMeter.Server.ini On Linux, the definition of that variable is in the file /etc/wibu/CodeMeter/Server.ini On Solaris, the definition of that variable is in the file/etc/opt/CodeMeter/Server.ini For further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Product Security Advisories WIBU-231024-01 and WIBU-231017-01 at Website https://www.wibu.com/support/security-advisories.html. Until an update is available for e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) we strongly encourage users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version.
- Mitigation
Disable using a SOCKS5 proxy: The proxy environment variables HTTP_PROXY, HTTPS_PROXY and ALL_PROXY must not be set to socks5h:// Ensure that CodeMeter is not defined to use the SOCKS5 proxy. The variable ProxyServer must not be start with socks5h://. On Windows, the definition of that variable is in the registry (regedit) under HKLM/SOFTWARE/WIBU-SYSTEMS/CodeMeter/Server/CurrentVersion On Mac, the definition of that variable is in the file /Library/Preferences/com.wibu.CodeMeter.Server.ini On Linux, the definition of that variable is in the file /etc/wibu/CodeMeter/Server.ini On Solaris, the definition of that variable is in the file/etc/opt/CodeMeter/Server.ini For further details on risk mitigation and impact of this vulnerability, please refer to the official WIBU-SYSTEMS Product Security Advisories WIBU-231024-01 and WIBU-231017-01 at Website https://www.wibu.com/support/security-advisories.html. Until an update is available for e!COCKPIT and WAGO-I/O-Pro (CODESYS 2.3) we strongly encourage users to update WIBU-SYSTEMS Codemeter by installing the latest available stand-alone WIBU-SYSTEMS Codemeter Version.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan