SSA-936080

csafDEsiemens_psirt

SSA-936080: Multiple Vulnerabilities in Third-Party Component libcurl

Advisory ansehen veröffentlicht 2021-03-09

SIMATIC CM 1542-1, SCALANCE SC600 family and SIMATIC CP 343-1 Advanced devices are vulnerable to a vulnerability in the third party component libcurl that could allow an attacker to cause a Denial-of-Service condition on the affected devices. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. The impact of additional libcurl vulnerabilities is described in Siemens Security Advisory SSA-436177.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2019-3823UShigh7.5—
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (6)

  • MitigationSCALANCE SC600 Family

    Disable the SMTP Client function on affected devices or use VPN for protecting SMTP traffic to trusted email servers only

  • MitigationSIMATIC CM 1542-1

    Disable the SMTP Client function on affected devices or use VPN for protecting SMTP traffic to trusted email servers only

  • MitigationSIMATIC CP 343-1 Advanced (incl. SIPLUS variants)

    Disable the SMTP Client function on affected devices or use VPN for protecting SMTP traffic to trusted email servers only

  • Kein Fix verfügbarSIMATIC CP 343-1 Advanced (incl. SIPLUS variants)

    Currently no remediation is available

  • BehobenSCALANCE SC600 Family

    Update to V2.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109769665/
  • BehobenSIMATIC CM 1542-1

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109801629/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan