Siemens BFCClient
Siemens BFCClient contains multiple vulnerabilities in the integrated OpenSSL component that could allow an attacker to read memory contents, to change the application behaviour or to create a denial of service condition. Siemens has released a new version for BFCClient and recommends to update to the latest version.
beschreibt (5)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-0464US | high7.5 | Exploit | ||
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints. Attacke… | ||||
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
| CVE-2021-3712US | high7.4 | Exploit | ||
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This cont… | ||||
| CVE-2021-3711US | critical9.8 | — | ||
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first tim… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-028723: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17 - CSAF Versionself
- SSA-028723: Multiple OpenSSL Vulnerabilities in BFCClient Before V2.17 - HTML Versionself
- ICS Advisory ICSA-25-226-21 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-25-226-21 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (6)
- MitigationBFCClient
Disable CRL (certification revocation list) checking, if possible
- BehobenBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- BehobenBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- BehobenBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- BehobenBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
- BehobenBFCClient
Update to V2.17 or later version. Contact customer support to obtain the update
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan