SSA-535640

csafDEsiemens_psirt

SSA-535640: Vulnerability in Industrial Products

Advisory ansehen veröffentlicht 2017-08-30

Various industrial products use the Discovery Service of the OPC UA protocol stack by the OPC foundation https://github.com/OPCFoundation/UA-.NETStandard and could therefore be affected by the remote resource consumption attacks (CVE-2017-12069).

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2017-12069UShigh8.2—
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are S…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (12)

  • MitigationSIMATIC IT Production Suite

    Turn off the Discovery Service after commissioning or block it on the local firewall: https://support.industry.siemens.com/cs/ww/en/view/109749461

  • MitigationSIMATIC NET PC Software V14

    Turn off the Discovery Service after commissioning or block it on the local firewall: https://support.industry.siemens.com/cs/ww/en/view/109749461

  • MitigationSIMATIC PCS 7

    Turn off the Discovery Service after commissioning or block it on the local firewall: https://support.industry.siemens.com/cs/ww/en/view/109749461

  • MitigationSIMATIC WinCC

    Turn off the Discovery Service after commissioning or block it on the local firewall: https://support.industry.siemens.com/cs/ww/en/view/109749461

  • MitigationSIMATIC WinCC Runtime Professional V13

    Turn off the Discovery Service after commissioning or block it on the local firewall: https://support.industry.siemens.com/cs/ww/en/view/109749461

  • MitigationSIMATIC WinCC Runtime Professional V14

    Turn off the Discovery Service after commissioning or block it on the local firewall: https://support.industry.siemens.com/cs/ww/en/view/109749461

  • Kein Fix geplantSIMATIC PCS 7

    Currently no fix is planned

  • Kein Fix geplantSIMATIC WinCC

    Currently no fix is planned

  • Kein Fix geplantSIMATIC WinCC Runtime Professional V13

    Currently no fix is planned

  • BehobenSIMATIC IT Production Suite

    Update to V7.1 or later version

  • BehobenSIMATIC NET PC Software V14

    Update to V14 SP1 Update 14 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109807351/
  • BehobenSIMATIC WinCC Runtime Professional V14

    Update to V14 SP1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109746276
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan