21.12.2021 05:13 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Updates vom 20.12.2021 |
22.12.2021 04:25 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Update vom 21.12.2021 |
23.12.2021 05:54 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Update vom 22.12.2021 |
28.12.2021 03:55 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Update vom 27.12.2021 |
29.12.2021 04:38 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Updates vom 28.12.2021 |
06.01.2022 03:29 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Update vom 05.01.2022 |
18.01.2022 03:44 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Update vom 17.01.2022 |
29.01.2022 06:05 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Update vom 28.01.2022 |
08.02.2022 14:47 | |
Beigetreten: 18.12.2014 Letzter Bes: 27.08.2024 Beiträge: 33629 Bewertung:
|
Update vom 07.02.2022 Andere CERT Mitteilungen: Ladies and Gentlemen, for your information: The following new advisories/bulletins have just been published on the Siemens ProductCERT web site [1]: SSA-244969: OpenSSL Vulnerability in Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf> SSA-301589: Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization * <https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf> SSA-539476: Siemens SIMATIC NET CP, SINEMA and SCALANCE Products Affected by Vulnerabilities in Third-Party Component strongSwan * <https://cert-portal.siemens.com/productcert/pdf/ssa-539476.pdf> SSA-609880: File Parsing Vulnerabilities in Simcenter Femap before V2022.1 * <https://cert-portal.siemens.com/productcert/pdf/ssa-609880.pdf> SSA-654775: Open Redirect Vulnerability in SINEMA Remote Connect Server * <https://cert-portal.siemens.com/productcert/pdf/ssa-654775.pdf> SSA-669737: Improper Access Control Vulnerability in SICAM TOOLBOX II * <https://cert-portal.siemens.com/productcert/pdf/ssa-669737.pdf> SSA-831168: Cross-Site Scripting Vulnerability in Spectrum Power 4 * <https://cert-portal.siemens.com/productcert/pdf/ssa-831168.pdf> SSA-838121: Multiple Denial of Service Vulnerabilities in Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf> SSA-914168: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf> SSA-978692: Apache Log4j Vulnerabilities - Impact to Siemens Energy Omnivise Fleet Management * <https://cert-portal.siemens.com/productcert/pdf/ssa-978692.pdf> Additionally, the following advisories / bulletins have just been updated on the Siemens ProductCERT web site [1]: SSA-100232: Denial-of-Service vulnerability in SCALANCE X Switches * <https://cert-portal.siemens.com/productcert/pdf/ssa-100232.pdf> * Specifically added that SCALANCE X204RNA devices do not have any fix planned SSA-102233: SegmentSmack in VxWorks-based Industrial Devices * <https://cert-portal.siemens.com/productcert/pdf/ssa-102233.pdf> * Added affected products SIMATIC CP 442-1 RNA and SIMATIC CP 443-1 RNA SSA-211752: Multiple NTP-Client Related Vulnerabilities in SIMATIC CP 443-1 OPC UA * <https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf> * No remediation planned for SIMATIC CP 443-1 OPC UA SSA-293562: Denial of Service Vulnerabilities in PROFINET DCP Implementation of Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-293562.pdf> * No remediation planned for SIMATIC CP 443-1 OPC UA; added more information to the advisory title; no remediation planned for ET200 devices SSA-307392: Denial of Service in OPC UA in Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf> * No remediation planned for SIMATIC CP 443-1 OPC UA SSA-309571: IPU 2021.1 Vulnerabilities in Siemens Industrial Products using Intel CPUs (June 2021) * <https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf> * Added affected product SINUMERIK ONE NCU 1740 SSA-316383: NumberJack Vulnerability in LOGO! CMR and SIMATIC RTU 3000 devices * <https://cert-portal.siemens.com/productcert/pdf/ssa-316383.pdf> * Expanded SIMATIC RTU 3000 family to specific individual affected products and added remediation for all the entries SSA-346262: Denial-of-Service in Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-346262.pdf> * Clarified that no remediation is planned for ET200 devices SSA-349422: Denial-of-Service in Industrial Real-Time (IRT) Devices * <https://cert-portal.siemens.com/productcert/pdf/ssa-349422.pdf> * Clarified that no remediation is planned for ET200 devices SSB-439005: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP * <https://cert-portal.siemens.com/productcert/pdf/ssb-439005.pdf> * Added an initial set of vulnerabilities for V2.9.4, and the following for V2.9.3: CVE-2021-3997, CVE-2021-3998, CVE-2021-3999, CVE-2021-4157, CVE-2021-22600, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827, CVE-2022-23852 SSA-443566: Authentication Bypass in SCALANCE X Switches Families * <https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf> * Specifically added that SCALANCE X204RNA devices do not have any fix planned SSA-462066: Vulnerability known as TCP SACK PANIC in Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf> * Updated solution for SIMATIC CP 1623; Clarified that currently no remediation is planned for SIMATIC CP 442-1 RNA, SIMATIC CP 443-1 RNA, TIM 3V-IE and TIM 4R-IE devices SSA-473245: Denial-of-Service Vulnerability in Profinet Devices * <https://cert-portal.siemens.com/productcert/pdf/ssa-473245.pdf> * Clarified that no remediation is planned for ET200 devices SSA-480230: Denial of service in Webserver of Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf> * No remediation planned for SIMATIC CP 343-1 Advanced, SIMATIC CP 443-1 OPC UA, SIMATIC CP 1604, SIMATIC CP 1616, and SIPLUS NET CP 343-1 Advanced SSA-541018: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SENTRON PAC / 3VA Devices (Part 2) * <https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf> * Added solution for SENTRON PAC2200 (with and without MID approval) SSA-593272: SegmentSmack in Interniche IP-Stack based Industrial Devices * <https://cert-portal.siemens.com/productcert/pdf/ssa-593272.pdf> * No remediation planned for SIMATIC ET200 devices SSA-599968: Denial-of-Service Vulnerability in Profinet Devices * <https://cert-portal.siemens.com/productcert/pdf/ssa-599968.pdf> * Clarified that no remediation is planned for SCALANCE W700 and SCALANCE W1700, SIMATIC CP 1604, SIMATIC CP 1616, and SIMATIC CP 1626 SSA-661247: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf> * Added solution for Spectrum Power 4 and 7 (incl. jROS), for Teamcenter Technical Publishing and for Xpedition Enterprise and IC Packaging, versions VX.2.7, VX.2.8, VX.2.10; added additional products considered as not affected SSA-675303: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf> * Added solution for SINEC INS SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000 * <https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf> * Revised severity of CVE-2021-45046; added specific document title provided in Siemens Energy customer portal SSA-772220: OpenSSL Vulnerabilities in Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf> * Added solution for SCALANCE LPE9403; clarified that no remediation is planned for SCALANCE W-1700 IEEE 802.11ac family; added RUGGEDCOM CROSSBOW Station Access Controller as affected product ; fixed affected versions for SINEC NMS SSA-780073: Denial of Service Vulnerability in PROFINET Devices via DCE-RPC Packets * <https://cert-portal.siemens.com/productcert/pdf/ssa-780073.pdf> * No remediation planned for SIMATIC CP 343-1 (incl. Advanced, ERPC, Lean and related SIPLUS variants), SIMATIC CP 443-1 OPC UA, SIMATIC ET200 devices, and SOFTNET-IE PNIO SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf> * Added solution for SIMATIC WinCC V16 and V17 and adjusted solution for SIMATIC PCS 7 V9.1 SSA-913875: Frame Aggregation and Fragmentation Vulnerabilities in 802.11 * <https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf> * Added solution for SCALANCE W-700 IEEE 802.11ax family, updated name and split into individual products the SCALANCE W-700 and SCALANCE W-1700 families and clarified that no remediation is planned for SCALANCE W-700 IEEE 802.11n and SCALANCE W-1700 families SSA-978220: Denial of Service Vulnerability over SNMP in Multiple Industrial Products * <https://cert-portal.siemens.com/productcert/pdf/ssa-978220.pdf> * No remediation planned for SIMATIC CP 443-1 OPC UA, SIMATIC CP 343-1 Advanced, SIPLUS NET CP 343-1 Advanced SSA-995338: Multiple Vulnerabilities in COMOS Web * <https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf> * Added CVE-2021-37194 and Updated Affected Products |
Für diesen Beitrag bedanken sich
1 Benutzer |
Folgen Sie uns auf