SSA-285795

csafDEsiemens_psirt

SSA-285795: Denial of Service in OPC-UA in Industrial Products

Advisory ansehen veröffentlicht 2022-05-10

A vulnerability in the underlying third party component OPC UA ANSIC Stack (also called Legacy C-Stack) affects several industrial products. The vulnerability could cause a crash of the component that includes the vulnerable part of the stack. Siemens has released updates for the affected products and recommends to update to the latest versions.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2021-45117USmedium6.5—
The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference.
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (18)

  • MitigationSIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants)

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationSIMATIC HMI Comfort Panels (incl. SIPLUS variants)

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationSIMATIC NET PC Software V14

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationSIMATIC NET PC Software V15

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationSIMATIC NET PC Software V16

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationSIMATIC NET PC Software V17

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationSITOP Manager

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • MitigationTeleControl Server Basic V3

    Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners

  • Kein Fix geplantSIMATIC NET PC Software V15

    Currently no fix is planned

  • BehobenSIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants)

    Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer

    https://support.industry.siemens.com/cs/ww/en/view/109746530/
  • BehobenSIMATIC HMI Comfort Panels (incl. SIPLUS variants)

    Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer

    https://support.industry.siemens.com/cs/ww/en/view/109746530/
  • BehobenSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F

    Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer

    https://support.industry.siemens.com/cs/ww/en/view/109746530/
  • BehobenSIMATIC NET PC Software V14

    Update to V14 SP1 Update 14 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109807351/
  • BehobenSIMATIC NET PC Software V16

    Update to V16 Update 6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109811815/
  • BehobenSIMATIC NET PC Software V17

    Update to V17 SP1 or later version

  • BehobenSITOP Manager

    Update to V1.2.4 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109760607/
  • BehobenTeleControl Server Basic V3

    Update to V3.1.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109812231/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan