OpenSSL vulnerability affects multiple SICK SIMs
In March 2022, the OpenSSL development team disclosed a denial of service in versions "3.0.0," "3.0.1," "1.1.1"-"1.1.1m" and "1.0.2-1.0.2zc" of the OpenSSL library. Exploiting this vulnerability allows remote, unauthenticated attackers to cause an infinite loop. It is possible to trigger the infinite loop by creating a certificate that has invalid explicit curve parameters or when parsing created private keys, as they may contain explicit elliptic curve parameters. It may be possible to put the SIMs in a non-responsive state since 100% of the CPU resource is consumed by the infinite loop calculation. The listed SICK SIM products are currently operated with an OpenSSL version that is vulnerable to CVE-2022-0778. With that it could be possible to exploit the mentioned vulnerability if the SIM devices are connected to a network with untrusted devices. In that case an untrusted client may send a manipulated SSH-certificate to the SIM, which exploits the vulnerability in the OpenSSL library as described above when it comes to the certificate validation by the SIM product. Evaluation is undergoing.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (17)
- Kein Fix verfügbarSICK SIM1000 FX with Firmware <= 1.5.2
The recommended solution will be the update of the firmware to a version >= 1.6.0 (in progress, release not yet scheduled).
- Kein Fix verfügbarSICK SIM1004 with Firmware <= 1.1.0
The recommended solution will be the update of the firmware to a version >= 2.0.0 (in progress, release not yet scheduled).
- Kein Fix verfügbarSICK SIM1012 with Firmware <= 2.0.6
The recommended solution will be the update of the firmware to a version >= 2.1.0 (in progress, release not yet scheduled).
- Kein Fix verfügbarSICK SIM2000ST Track & Trace (2086501) with Firmware <= 1.7.0
The recommended solution will be the update of the firmware to a version >= 1.7.1 (release not yet scheduled). Please see “Workaround”.
- Kein Fix verfügbarSICK SIM2000ST Track & Trace (2086502) with Firmware <= 1.13.2
The recommended solution will be the update of the firmware to a version >= 1.13.3 (release not yet scheduled).
- Kein Fix verfügbarSICK SIM2000ST with Firmware <= 1.7.0
The recommended solution will be the update of the firmware to a version >= 1.7.1 (release not yet scheduled). Please see “Workaround”.
- Kein Fix verfügbarSICK SIM4000 with Firmware <= 1.10.1
The recommended solution will be the update of the firmware to a version >= 1.10.2 (release not yet scheduled). Please see “Workaround”.
- BehobenSICK SIM2000-2 P Track & Trace with Firmware <1.7.0
The recommended solution is to update the firmware to a version >= 1.7.0 as soon as possible.
- BehobenSICK SIM2000ST-E with Firmware <1.7.0
The recommended solution is to update the firmware to a version >= 1.7.0 as soon as possible.
- BehobenSICK SIM2x00 with Firmware <1.2.0
The recommended solution is to update the firmware to a version >= 1.2.0 as soon as possible.
- WorkaroundSICK SIM1000 FX with Firmware <= 1.5.2
In the runtime context of an SIM application, the SSH access should not be required at all, it is recommended as a workaround to disable port 22 (SSH) of the corresponding Ethernet port at the SIM via App (Firewall-API).
- WorkaroundSICK SIM1004 with Firmware <= 1.1.0
In the runtime context of an SIM application, the SSH access should not be required at all, it is recommended as a workaround to disable port 22 (SSH) of the corresponding Ethernet port at the SIM via App (Firewall-API).
- WorkaroundSICK SIM1012 with Firmware <= 2.0.6
In the runtime context of an SIM application, the SSH access should not be required at all, it is recommended as a workaround to disable port 22 (SSH) of the corresponding Ethernet port at the SIM via App (Firewall-API).
- WorkaroundSICK SIM2000ST Track & Trace (2086501) with Firmware <= 1.7.0
In the runtime context of an SIM application, the SSH access should not be required at all, it is recommended as a workaround to disable port 22 (SSH) of the corresponding Ethernet port at the SIM via App (Firewall-API).
- WorkaroundSICK SIM2000ST Track & Trace (2086502) with Firmware <= 1.13.2
In the runtime context of an SIM application, the SSH access should not be required at all, it is recommended as a workaround to disable port 22 (SSH) of the corresponding Ethernet port at the SIM via App (Firewall-API).
- WorkaroundSICK SIM2000ST with Firmware <= 1.7.0
In the runtime context of an SIM application, the SSH access should not be required at all, it is recommended as a workaround to disable port 22 (SSH) of the corresponding Ethernet port at the SIM via App (Firewall-API).
- WorkaroundSICK SIM4000 with Firmware <= 1.10.1
In the runtime context of an SIM application, the SSH access should not be required at all, it is recommended as a workaround to disable port 22 (SSH) of the corresponding Ethernet port at the SIM via App (Firewall-API).
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan