SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products
CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section "Vulnerability Classification" below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and CVE-2020-16233. Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, attain remote code execution, or prevent normal operation of the Siemens software that depends on CodeMeter Runtime. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
beschreibt (6)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-16233US | high7.5 | — | ||
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap. | ||||
| CVE-2020-14519US | high7.5 | — | ||
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected We… | ||||
| CVE-2020-14517US | critical9.8OT erhöht | — | ||
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and… | ||||
| CVE-2020-14515US | high7.5 | — | ||
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows… | ||||
| CVE-2020-14513US | high7.5 | — | ||
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields. | ||||
| CVE-2020-14509US | critical9.8 | — | ||
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send s… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (90)
- MitigationPSS CAPE Protection Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationPSS CAPE Protection Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationPSS CAPE Protection Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationPSS CAPE Protection Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationPSS CAPE Protection Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationPSS CAPE Protection Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSICAM 230
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSICAM 230
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSICAM 230
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSICAM 230
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSICAM 230
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSICAM 230
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Information Server 2019
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Information Server 2019
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Information Server 2019
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Information Server 2019
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC PCS neo
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC PCS neo
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC PCS neo
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC PCS neo
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC PCS neo
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC PCS neo
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC WinCC OA
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC WinCC OA
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC WinCC OA
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMATIC WinCC OA
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMIT Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMIT Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMIT Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMIT Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMIT Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSIMIT Simulation Platform
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSINEC INS
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSINEC INS
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSINEC INS
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSINEC INS
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSINEMA Remote Connect
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSINEMA Remote Connect
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- MitigationSINEMA Remote Connect
All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- Kein Fix geplantSICAM 230
Currently no remediation is planned
- BehobenPSS CAPE Protection Simulation Platform
CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime
- BehobenPSS CAPE Protection Simulation Platform
CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime
- BehobenPSS CAPE Protection Simulation Platform
CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime
- BehobenPSS CAPE Protection Simulation Platform
CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime
- BehobenPSS CAPE Protection Simulation Platform
CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime
- BehobenPSS CAPE Protection Simulation Platform
CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime
- BehobenSIMATIC Information Server 2019
Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Information Server 2019
Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Information Server 2019
Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Information Server 2019
Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC PCS neo
Update to V3.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC PCS neo
Update to V3.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC PCS neo
Update to V3.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC PCS neo
Update to V3.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC PCS neo
Update to V3.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC PCS neo
Update to V3.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)
Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1
https://support.industry.siemens.com/cs/ww/en/view/109784449/ - BehobenSIMATIC WinCC OA
Update to V3.17 P007 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA
Update to V3.17 P007 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA
Update to V3.17 P007 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMATIC WinCC OA
Update to V3.17 P007 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - BehobenSIMIT Simulation Platform
Update to V10.2 Upd1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794248/ - BehobenSIMIT Simulation Platform
Update to V10.2 Upd1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794248/ - BehobenSIMIT Simulation Platform
Update to V10.2 Upd1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794248/ - BehobenSIMIT Simulation Platform
Update to V10.2 Upd1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794248/ - BehobenSIMIT Simulation Platform
Update to V10.2 Upd1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794248/ - BehobenSIMIT Simulation Platform
Update to V10.2 Upd1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794248/ - BehobenSINEC INS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793469/ - BehobenSINEC INS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793469/ - BehobenSINEC INS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793469/ - BehobenSINEC INS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793469/ - BehobenSINEMA Remote Connect
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/ - BehobenSINEMA Remote Connect
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/ - BehobenSINEMA Remote Connect
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan