Share: Email | Twitter

ID

VDE-2022-019

Published

2022-06-02 17:11 (CEST)

Last update

2022-06-02 17:11 (CEST)

Vendor(s)

Endress+Hauser AG

Product(s)

Article No° Product Name Affected Version(s)
SFE100 DeviceCare 1.02.xx <= 1.07.06
SFE500 FieldCare 2.15.xx <= 2.16.xx
MS20 Field Data Manager 1.4.0 <= 1.6.2
MS21 Field Data Manager 1.4.0 <= 1.6.2
SMT50 Field Xpert 1.03.xx <= 1.05.xx
SMT70 Field Xpert 1.03.xx <= 1.05.xx
SMT77 Field Xpert 1.03.xx <= 1.05.xx
Proline Promag W 800 OPC/UA Connectivity Server = V1.3.7926
SCE30B SupplyCare Enterprise 3.0.x <= 3.4.x
SCE31B SupplyCare Enterprise 3.0.x <= 3.4.x
SCE32B SupplyCare Enterprise 3.0.x <= 3.4.x

Summary

For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

Vulnerabilities



CVE-2021-20093
9.1
Severity
9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness
Out-of-bounds Read (CWE-125)
Summary

A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or crash the CodeMeter Runtime Server.

Source
nvd.nist.gov 
CVE-2021-22901
8.1
Severity
8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Use After Free (CWE-416)
Summary

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can ...

Source
nvd.nist.gov 
CVE-2021-20094
7.5
Severity
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness
Out-of-bounds Read (CWE-125)
Summary

A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server.

Source
nvd.nist.gov 
CVE-2020-8286
7.5
Severity
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness
Improper Certificate Validation (CWE-295)
Summary

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Source
nvd.nist.gov 
CVE-2021-41057
7.1
Severity
7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness
Improper Link Resolution Before File Access ('Link Following') (CWE-59)
Summary

In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.

Source
nvd.nist.gov 
CVE-2021-41184
6.1
Severity
6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. ...

Source
nvd.nist.gov 
CVE-2021-41182
6.1
Severity
6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. ...

Source
nvd.nist.gov 
CVE-2021-41183
6.1
Severity
6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. ...

Source
nvd.nist.gov 

Solution

Mitigation

All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b.

The version is available at https://www.wibu.com/support.

For the Operating System WIN 7 it´s recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.

Remediation

Update the software application of the affected products:

# Product Name Fixed Version

SCE30B
SCE31B
SCE32B

 SupplyCare Enterprise >= 3.5.1
SFE100 DeviceCare >= 1.07.07
SFE500 FieldCare >= 2.17.00
SMT50
SMT70
SMT77		 Field Xpert >= 1.06.00
MS20
MS21		 Field Data Manager >= 1.6.3
Freeware for the
Proline Promag W 800/5W8C
via Endress+Hauser Download Portal		 Proline Promag W 800 OPC/UA Connectivity Server > V1.3.7926

Reported by

CERT@VDE coordinated with ENDRESS+HAUSER