SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400
SIDIS Prime before V4.0.400 is affected by multiple vulnerabilities in the components OPC UA and OpenSSL, that could allow an unauthenticated attacker with access to the network where SIDIS Prime is installed to reuse OPC UA client credentials, create a denial of service condition of the SIDIS Prime OPC UA client, or create a denial of service condition of the SIDIS Prime TLS service. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
beschreibt (5)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-29862US | high7.5 | — | ||
An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message. | ||||
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
| CVE-2020-1971US | medium5.9 | Exploit | ||
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_c… | ||||
| CVE-2020-1967US | high7.5 | Exploit | ||
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect hand… | ||||
| CVE-2019-19135US | high7.4OT erhöht | — | ||
In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows ma… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - CSAF Versionself
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - HTML Versionself
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - PDF Versionself
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - TXT Versionself
Behebungen (6)
- MitigationSIDIS Prime
CVE-2019-19135: Enable encrypted communication between the affected product (OPC UA client) and the OPC UA server(s)
- BehobenSIDIS Prime
Update to V4.0.400 or later version
- BehobenSIDIS Prime
Update to V4.0.400 or later version
- BehobenSIDIS Prime
Update to V4.0.400 or later version
- BehobenSIDIS Prime
Update to V4.0.400 or later version
- BehobenSIDIS Prime
Update to V4.0.400 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan