SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products
WIBU Systems published information about a denial-of-service vulnerability and an associated fix release version of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerability is described in the section "Vulnerability Classification" below and got assigned the CVE ID CVE-2021-41057. Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server (i.e., CodeMeter.exe), which could cause a denial-of-service condition for the affected Siemens product. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-41057US | high7.1 | — | ||
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products - CSAF Versionself
- SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products - PDF Versionself
- SSA-580693: WIBU Systems CodeMeter Runtime Denial-of-Service Vulnerability in Siemens Products - TXT Versionself
Behebungen (17)
- MitigationSIMATIC Information Server
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC PCS neo
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC Process Historian (incl. Process Historian OPC UA Server)
Harden the application server to prevent local access by untrusted personnel.
- MitigationSIMATIC WinCC OA V3.17
Limit local access to the WinCC OA server by hardening measures according to the security guideline.
- MitigationSIMATIC WinCC OA V3.18
Limit local access to the WinCC OA server by hardening measures according to the security guideline.
- Kein Fix geplantSICAM 230
Currently no fix is planned
- BehobenPSS(R)CAPE
CAPE 14 installations installed from material dated 2021-10-05 or later are not affected, as they contain a fixed version of CodeMeter Runtime.
- BehobenPSS(R)E V34
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - BehobenPSS(R)E V35
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - BehobenPSS(R)ODMS V12
Alternatively, install WIBU Systems CodeMeter Runtime V7.30a manually to fix the issue: Download the package from https://www.wibu.com/us/support/user/downloads-user-software.html and follow the installation instructions from WIBU Systems. Contact PSS(R) Support via the Customer Support Portal: https://siemens- pss.freshdesk.com/en/support/login, if you need assistance with patching affected systems.
https://siemens-pss.com/ - BehobenSICAM 230
Update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.30a: Download the package from: https://www.wibu.com/us/support/user/downloads-user-software.html. Install it on SICAM 230 systems according to the procedure documented in chapter 9.2 of the COPA-DATA Security Vulnerability Announcement 2021_2: https://www.copadata.com/fileadmin/user_upload/faq/files/CD_S VA_2021_2.pdf.
- BehobenSIMATIC Information Server
To update, use the Information Server version as bundled with PCS neo V3.1 Upd1 (https://support.industry.siemens.com/cs/ww/en/view/109804750/) or with PCS 7 V9.1 SP1 (https://support.industry.siemens.com/cs/ww/en/view/109805073/)
- BehobenSIMATIC PCS neo
Update to V3.1 Upd 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109804750/ - BehobenSIMATIC Process Historian (incl. Process Historian OPC UA Server)
To update, use the Process Historian version as bundled with PCS neo V3.1 Upd1 (https://support.industry.siemens.com/cs/ww/en/view/109804750/) or with PCS 7 V9.1 SP1 (https://support.industry.siemens.com/cs/ww/en/view/109805073/)
- BehobenSIMATIC WinCC OA V3.17
Update to V3.17 P015 or later version
https://www.winccoa.com/downloads/category/versions- patches.html - BehobenSIMATIC WinCC OA V3.18
Update to V3.18 P005 or later version
https://www.winccoa.com/downloads/category/versions- patches.html - BehobenSIMIT Simulation Platform
Update to V11.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810223/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan