SSA-400332: Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Questa and ModelSim
A security research [1] identified weaknesses in the IEEE 1735 recommended practice for encryption of Design IP, which could allow a sophisticated attacker access to unencrypted Design IP data in IEEE 1735-compliant products. This advisory addresses the specific details for the affected Siemens software products: Questa and ModelSim simulators. Siemens is preparing updates and recommends specific countermeasures for Questa and ModelSim. [1] https://arxiv.org/abs/2112.04838
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-42023US | medium6.5 | Exploit | ||
A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected applications insufficientl… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-400332: Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Questa and ModelSim - CSAF Versionself
- SSA-400332: Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Questa and ModelSim - PDF Versionself
- SSA-400332: Insufficient Design IP Protection in IEEE 1735 Recommended Practice - Impact to Questa and ModelSim - TXT Versionself
Behebungen (4)
- MitigationModelSim Simulation
Companies that deliver encrypted design IP data to their customers: ensure that procedural and contractual measures are in place that minimize the risk of unauthorized access to the data.
- MitigationQuesta Simulation
Companies that deliver encrypted design IP data to their customers: ensure that procedural and contractual measures are in place that minimize the risk of unauthorized access to the data.
- BehobenModelSim Simulation
Update to new releases as they become available (see also section Additional Information)
https://support.sw.siemens.com/en-US/product/852852093/ - BehobenQuesta Simulation
Update to new releases as they become available (see also section Additional Information)
https://support.sw.siemens.com/en-US/product/852852103/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan