SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products
Multiple vulnerabilities were identified in the Apache HTTP Server software. These include NULL Pointer Dereferencing, Out-of-bounds Write and Server-Side Request Forgery related vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-40438US | critical9.0OT kritisch | KEV | ||
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | ||||
| CVE-2021-39275US | critical9.8 | — | ||
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules m… | ||||
| CVE-2021-34798US | high7.5 | — | ||
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products - CSAF Versionself
- SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products - PDF Versionself
- SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products - TXT Versionself
Behebungen (16)
- MitigationRUGGEDCOM NMS
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEC NMS
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEC NMS
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEC NMS
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEMA Remote Connect Server
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEMA Server V14
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEMA Server V14
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEMA Server V14
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- Kein Fix geplantRUGGEDCOM NMS
Currently no fix is planned
- Kein Fix geplantSINEMA Server V14
Currently no fix is planned
- Kein Fix geplantSINEMA Server V14
Currently no fix is planned
- Kein Fix geplantSINEMA Server V14
Currently no fix is planned
- BehobenSINEC NMS
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/ - BehobenSINEC NMS
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/ - BehobenSINEC NMS
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/ - BehobenSINEMA Remote Connect Server
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811169/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan