Vulnerability in Wibu-Systems CodeMeter Runtime affects multiple SICK products
Wibu-Systems disclosed a security vulnerability in the CodeMeter Runtime. There is a heap buffer overflow vulnerability which can potentially lead to a remote code execution. Currently, no PoC is known to Wibu-Systems. To exploit the heap overflow, additional protection mechanisms need to be broken. Remote access is only possible if CodeMeter is configured as a server. If CodeMeter is not configured as a server, the adversary would need to log in to the machine where the CodeMeter Runtime is running or trick the user into sending a malicious request to CodeMeter.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-3935US | — | — | ||
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (10)
- MitigationAppEngine
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationCODE-LOC
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationFlowGate
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationLiDAR-LOC
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationSIM2000ST-E
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - MitigationTDC-E
If possible, run CodeMeter as client only. Otherwise restrict access to server to required clients only by implementing an access list. General security best practices can help to protect systems from local and network attacks.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - BehobenAppEngine
Update to a codemeter runtime version >=7.60c. * Linux x86: * Stop running SICK AppEngine * Uninstall Codemeter: sudo dpkg -r CodeMeter * Download Codemeter >= 7.60c * Install Codemeter: sudo dpkg -i ./codemeter_7.xx.xxxx.xxx_amd64.deb * Start SICK AppEngine * Windows: * Stop running SICK AppEngine * Uninstall Codemeter using Windows settings app * Download Codemeter >= 7.60c * Install CodeMeterRuntime.exe * Enter URL in browser: http://localhost:22352/configuration/server_access.html * Configuration > Server > Server Access * Check Network Server enabled * Start SICK AppEngine
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - BehobenCODE-LOC
Update to a version >= 2.4.1.
- BehobenFlowGate
Update to a codemeter runtime version >=7.60c.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-230704-01-v3.0.pdf - BehobenLiDAR-LOC
Update to a version >= 2.4.1.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan