Bulletins | CERT@VDE

SSA-462066 V2.4 (Last Update: 2021-07-13): Vulnerability known as TCP SACK PANIC in Industrial Products

Titel

SSA-462066 V2.4 (Last Update: 2021-07-13): Vulnerability known as TCP SACK PANIC in Industrial Products

Veröffentlicht

13. Juli 2021 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-462066.pdf

Text

Multiple industrial products are affected by a vulnerability in the kernel known as TCP SACK PANIC. The vulnerability could allow a remote attacker to cause a denial of service condition. Siemens has released updates for several affected products and recommends to update to the new versions. Siemens is preparing further ...

SSA-913875 V1.0: Frame Aggregation and Fragmentation Vulnerabilities in 802.11

Titel

SSA-913875 V1.0: Frame Aggregation and Fragmentation Vulnerabilities in 802.11

Veröffentlicht

13. Juli 2021 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf

Text

Twelve vulnerabilities in the implementation of frame aggregation and fragmentation of the 802.11 standard, under the name of FragAttacks, have been published. Successful exploitation of these vulnerabilities could allow an attacker within Wi-Fi range to forge encrypted frames, which could result in sensitive data disclosure and possibly traffic manipulation. The ...

SSA-941426 V1.0: Multiple LLDP Vulnerabilities in Industrial Products

Titel

SSA-941426 V1.0: Multiple LLDP Vulnerabilities in Industrial Products

Veröffentlicht

13. Juli 2021 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf

Text

There are multiple vulnerabilities in an underlying Link Layer Discovery Protocol (LLDP) third party library. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.

SSA-203306 V1.5 (Last Update: 2021-07-13): Password Vulnerabilities in SIPROTEC 4 and SIPROTEC Compact Relay Families

Titel

SSA-203306 V1.5 (Last Update: 2021-07-13): Password Vulnerabilities in SIPROTEC 4 and SIPROTEC Compact Relay Families

Veröffentlicht

13. Juli 2021 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf

Text

SIPROTEC 4 and SIPROTEC Compact devices could allow access authorization passwords to be reconstructed or overwritten via engineering mechanisms that involve DIGSI 4 and EN100 Ethernet communication modules. Siemens has released updates for several affected products, and recommends specific countermeasures for the remaining products.

SSA-324955 V1.2 (Last Update: 2021-07-13): SAD DNS Attack in Linux Based Products

Titel

SSA-324955 V1.2 (Last Update: 2021-07-13): SAD DNS Attack in Linux Based Products

Veröffentlicht

13. Juli 2021 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-324955.pdf

Text

A vulnerability made public under the name SAD DNS affects Domain Name System resolvers due to a vulnerability in the Linux kernel when handling ICMP packets. The Siemens products which are affected are listed below. For more information please see https://www.saddns.net/. Siemens has released updates for several affected products and ...

Donnerstag, 01.07.2021

16:20

Sensormatic Electronics C-CURE 9000

Titel

Sensormatic Electronics C-CURE 9000

Veröffentlicht

1. Juli 2021 16:20

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-182-02

Text

This advisory contains mitigations for an Improper Input Validation vulnerability in Sensormatic Electronics C-CURE 9000 industrial software.

16:15

Delta Electronics DOPSoft

Titel

Delta Electronics DOPSoft

Veröffentlicht

1. Juli 2021 16:15

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03

Text

This advisory contains mitigations for Out-of-bounds Read vulnerabilities in Delta Electronics DOPSoft software.

16:10

Mitsubishi Electric Air Conditioning System

Titel

Mitsubishi Electric Air Conditioning System

Veröffentlicht

1. Juli 2021 16:10

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-182-04

Text

This advisory contains mitigations for an Incorrect Implementation of Authentication Algorithm vulnerability in Mitsubishi Electric air conditioning systems.

16:05

Mitsubishi Electric Air Conditioning Systems

Titel

Mitsubishi Electric Air Conditioning Systems

Veröffentlicht

1. Juli 2021 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-182-05

Text

This advisory contains mitigations for an Improper Restriction of XML External Entity Reference vulnerability in Mitsubishi Electric Air Conditioning Systems.

16:00