B&R Automation Studio
Successful exploitation of these vulnerabilities could allow an attacker to delete arbitrary files from this system, fetch arbitrary files, or perform arbitrary write operations.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-19102US | high7.5 | — | ||
A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to cert… | ||||
| CVE-2019-19101US | medium5.9 | — | ||
A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.… | ||||
| CVE-2019-19100US | high7.1 | — | ||
A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP, < 4.7.2 and < 4.8.1… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (6)
- MitigationAutomation Studio
Access to zip archives is controlled and access of the zip archive is limited to trusted parties only.
- MitigationAutomation Studio
Access to zip archives is controlled and access of the zip archive is limited to trusted parties only.
- MitigationAutomation Studio
Access to zip archives is controlled and access of the zip archive is limited to trusted parties only.
- BehobenAutomation Studio
Automation Studio 4.3 and later should be switched from the SharpZipLib to the .NET Framework, provided native ZIP archive implementation. For these versions the issue is not reproducible. For prior versions of Automation Studio, it is recommended to update the installation.
- BehobenAutomation Studio
Automation Studio 4.3 and later should be switched from the SharpZipLib to the .NET Framework, provided native ZIP archive implementation. For these versions the issue is not reproducible. For prior versions of Automation Studio, it is recommended to update the installation.
- BehobenAutomation Studio
Automation Studio 4.3 and later should be switched from the SharpZipLib to the .NET Framework, provided native ZIP archive implementation. For these versions the issue is not reproducible. For prior versions of Automation Studio, it is recommended to update the installation.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan