SSA-788287: Disclosure of Private Data
Due to SmartClient Installation technology (ClickOnce) a customer/integrator needs to create a customer specific Smartclient installer. The mentioned products delivered a trusted but yet expired codesigning certificate. An attacker could have exploited the vulnerability by spoofing the code-signing certificate and signing a malicious executable resulting in having a trusted digital signature from a trusted provider. The certificate was revoked immediately.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-27389US | critical9.8OT erhöht | — | ||
A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequ… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- MitigationOpcenter Quality
Explicitly distrust the certificate with the fingerprint FA:53:A4:74:FC:1E:16:6F:E6:6A:D2:5A:C1:E6: 8B:B1:91:CB:38:E9:85:7E:07:79:C1:A5:C3:59:1A:5A:04:96
- MitigationQMS Automotive
Explicitly distrust the certificate with the fingerprint FA:53:A4:74:FC:1E:16:6F:E6:6A:D2:5A:C1:E6: 8B:B1:91:CB:38:E9:85:7E:07:79:C1:A5:C3:59:1A:5A:04:96
- Kein Fix verfügbarOpcenter Quality
Currently no remediation is available
- Kein Fix verfügbarQMS Automotive
Currently no remediation is available
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan