SB2023112223 - Multiple vulnerabilities in Siemens SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family
Published: November 22, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Acceptance of Extraneous Untrusted Data With Trusted Data (CVE-ID: CVE-2023-44317)
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to the affected products do not properly validate the content of uploaded X509 certificates. A remote administrator can execute arbitrary code on the target device.
2) Improper access control (CVE-ID: CVE-2023-44374)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to affected devices insufficiently check which password is to be changed. A remote user can change the password and gain elevtaed privileges.
3) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2023-44373)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote administrator can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Unchecked Return Value (CVE-ID: CVE-2023-44322)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the affected devices can be configured to send emails when certain events occur on the device. A remote attacker can perform a denial of service (DoS) attack.
5) Resource exhaustion (CVE-ID: CVE-2023-44321)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote administrator can trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Direct Request ('Forced Browsing') (CVE-ID: CVE-2023-44320)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper authentication when performing certain modifications in the web interface. A remote user can influence the user interface configured by an administrator.
7) Reversible One-Way Hash (CVE-ID: CVE-2023-44319)
The vulnerability allows a user attacker to compromise the target system.
The vulnerability exists due to use of a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. A remote administrator can upload a modified configuration file to change the configuration of an affected device.
8) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2023-44318)
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to the usage a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. A remote administrator can obtain a configuration backup to extract configuration information from the exported file.
9) Resource management error (CVE-ID: CVE-2023-2650)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application when processing OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS subsystems with no message size limit. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.
10) NULL pointer dereference (CVE-ID: CVE-2023-0401)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error during PKCS7 data verification. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
11) NULL pointer dereference (CVE-ID: CVE-2023-0217)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when validating the DSA public key. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.
12) Release of invalid pointer or reference (CVE-ID: CVE-2023-0216)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to invalid pointer dereference in d2i_PKCS7 functions. A remote attacker can perform a denial of service (DoS) attack.
13) Double Free (CVE-ID: CVE-2022-4450)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the PEM_read_bio_ex() function. A remote attacker can pass specially crafted PEM file to the application, trigger a double free error and perform a denial of service (DoS) attack.
14) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2022-4304)
The vulnerability allows a remote attacker to obtain sensitive information.
The vulnerability exists due to a timing based side channel exists in the OpenSSL RSA Decryption implementation. A remote attacker can perform a Bleichenbacher style attack and decrypt data sent over the network.
To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.
15) Out-of-bounds read (CVE-ID: CVE-2022-4203)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when performing name constraint checking of the X.509 certificates. A remote attacker can pass a specially crafted X.509 certificate to the affected server, trigger an out-of-bounds read error and read contents of memory on the system.
Remediation
Install update from vendor's website.