Wibu-Systems CodeMeter Runtime
WIBU Systems published information about two vulnerabilities and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2021-20093 and CVE-2021-20094. Successful exploitation of these vulnerabilities could allow an attacker to read data from the heap of the CodeMeter Runtime network server, or crash the CodeMeter Runtime Server (i.e., CodeMeter.exe). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-20094US | high7.5 | — | ||
A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server… | ||||
| CVE-2021-20093US | critical9.1 | — | ||
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or cr… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-675303: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products - CSAF Versionself
- SSA-675303: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products - PDF Versionself
- SSA-675303: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products - TXT Versionself
- ICS Advisory ICSA-21-210-02 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-210-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (23)
- MitigationPSS(R)CAPE
If CAPE 14 was initially installed using earlier material, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.psscape.com/codemeter and install it the same way as documented for previous versions in the PSS CAPE 14 Installation Manual. Contact PSS(R)CAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.
- MitigationPSS(R)CAPE
If CAPE 14 was initially installed using earlier material, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.psscape.com/codemeter and install it the same way as documented for previous versions in the PSS CAPE 14 Installation Manual. Contact PSS(R)CAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.
- MitigationSICAM 230
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.21a or V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_1: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2021_1.pdf.
- MitigationSICAM 230
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.21a or V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_1: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2021_1.pdf.
- MitigationSIMATIC Information Server
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC PCS neo
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC Process Historian (incl. Process Historian OPC UA Server)
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running.
- MitigationSIMATIC WinCC OA V3.17
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running (for details refer to the updated security manual of WinCC OA).
- MitigationSIMATIC WinCC OA V3.18
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running (for details refer to the updated security manual of WinCC OA).
- MitigationSINEC INS
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running. Note that this is the default configuration, which therefore limits the exploitability to local attacks only.
- MitigationSINEMA Remote Connect Server
Limit remote access to port 22350/tcp on systems where the Codemeter runtime network server is running. Note that this is the default configuration, which therefore limits the exploitability to local attacks only.
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- BehobenPSS(R)CAPE
CAPE 14 installations installed from material dated 2021-06-16 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- BehobenPSS(R)CAPE
CAPE 14 installations installed from material dated 2021-06-16 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- BehobenSIMATIC Information Server
Update SIMATIC PCS neo to V3.1 or later version
- BehobenSIMATIC PCS neo
Update to V3.1 or later version
- BehobenSIMATIC Process Historian (incl. Process Historian OPC UA Server)
Update SIMATIC PCS neo to V3.1 or later version
- BehobenSIMATIC WinCC OA V3.17
Update to V3.17 P013 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA V3.18
Update to V3.18 P002 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMIT Simulation Platform
Alternatively, install WIBU Systems CodeMeter Runtime V7.21a or V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems.
https://support.industry.siemens.com/cs/ww/en/view/109800638/ - BehobenSINEC INS
Alternatively, update CodeMeter Runtime to V7.21a: Download the package "CodeMeter User Runtime for Linux, version 7.21a, Driver-only" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command: "sudo dpkg --force-depends --force-confnew -i codemeter-7.21.4611.501_amd64.deb"
https://support.industry.siemens.com/cs/ww/en/view/109806100/ - BehobenSINEMA Remote Connect Server
Update to V3.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan