Vulnerability in Wibu-Systems CodeMeter Runtime affects multiple SICK products
Wibu-Systems disclosed a security vulnerability in the CodeMeter Runtime. There is a heap buffer overflow vulnerability which can potentially lead to a remote code execution. Currently, no PoC is known to Wibu-Systems. To exploit the heap overflow, additional protection mechanisms need to be broken. Remote access is only possible if CodeMeter is configured as a server. If CodeMeter is not configured as a server, the adversary would need to log in to the machine where the CodeMeter Runtime is running or trick the user into sending a malicious request to CodeMeter.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-3935US | — | — | ||
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of… | ||||
references
External citations — patches, advisories, analysis.
remediations (10)
- MitigationAppEngine
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationCODE-LOC
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationFlowGate
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationLiDAR-LOC
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationSIM2000ST-E
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationTDC-E
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - FixedAppEngine
Update to a codemeter runtime version >=7.60c. * Linux x86: * Stop running SICK AppEngine * Uninstall Codemeter: sudo dpkg -r CodeMeter * Download Codemeter >= 7.60c * Install Codemeter: sudo dpkg -i ./codemeter_7.xx.xxxx.xxx_amd64.deb * Start SICK AppEngine * Windows: * Stop running SICK AppEngine * Uninstall Codemeter using Windows settings app * Download Codemeter >= 7.60c * Install CodeMeterRuntime.exe * Enter URL in browser: http://localhost:22352/configuration/server_access.html * Configuration > Server > Server Access * Check Network Server enabled * Start SICK AppEngine
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - FixedCODE-LOC
Update to a version >= 2.4.1.
- FixedFlowGate
Update to a codemeter runtime version >=7.60c.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - FixedLiDAR-LOC
Update to a version >= 2.4.1.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan