SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2
Multiple vulnerabilities in the third-party components cURL, BusyBox, libtirpc, Expat as well as in the Linux Kernel could allow an attacker to impact the SCALANCE XCM332 device's confidentiality, integrity and availability. Siemens has released an update for the SCALANCE XCM332 and recommends to update to the latest version.
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-35252US | low3.7 | — | ||
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server ret… | ||||
| CVE-2022-40674US | high8.1 | — | ||
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. | ||||
| CVE-2022-1729US | high7.0 | — | ||
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit pri… | ||||
| CVE-2021-46828US | high7.5 | — | ||
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lea… | ||||
| CVE-2022-32208US | medium5.9 | — | ||
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed… | ||||
| CVE-2022-32207US | critical9.8OT erhöht | — | ||
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final t… | ||||
| CVE-2022-32206US | medium6.5 | — | ||
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number o… | ||||
| CVE-2022-32205US | medium4.3 | — | ||
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookie… | ||||
| CVE-2022-1652US | high7.8 | — | ||
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a speciall… | ||||
| CVE-2022-30065US | high7.8 | — | ||
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - CSAF Versionself
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - HTML Versionself
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - PDF Versionself
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - TXT Versionself
Behebungen (10)
- BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - BehobenSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan