Share: Email | Twitter

ID

VDE-2019-013

Published

2019-06-12 12:25 (CEST)

Last update

2019-06-12 12:25 (CEST)

Vendor(s)

WAGO GmbH & Co. KG

Product(s)

Article No┬░ Product Name Affected Version(s)
852-1305 < V1.1.6.S0
852-1505 < V1.1.5.S0
852-303 < V1.2.2.S0

Summary

Multiple vulnerabilities have been identified in WAGO 852-303, 852-1305 and 852-1505 industrial managed ethernet switches.

Vulnerabilities



Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname ...
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary ...
Weakness
Use of Hard-coded Credentials (CWE-798)
Summary
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding ...
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.
Weakness
Use of Hard-coded Credentials (CWE-798)
Summary
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to ...
Weakness
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize ...
Weakness
Resource Management Errors (CWE-399)
Summary
The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause ...
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to ...
Weakness
Resource Management Errors (CWE-399)
Summary
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.
Weakness
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary
Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
Weakness
Integer Overflow or Wraparound (CWE-190)
Summary
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an ...
Weakness
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.
Weakness
Numeric Errors (CWE-189)
Summary
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary ...
Weakness
Improper Input Validation (CWE-20)
Summary
The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in ...
Weakness
Permissions, Privileges, and Access Controls (CWE-264)
Summary
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
Weakness
Permissions, Privileges, and Access Controls (CWE-264)
Summary
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared ...
Weakness
Improper Input Validation (CWE-20)
Summary
The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME ...
Weakness
NULL Pointer Dereference (CWE-476)
Summary
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.

Impact

(see cve details)

Solution

Update your managed switch to the latest firmware:

852-303 (>= V1.2.2.S0)
852-1305 (>= V1.1.6.S0)
852-1505 (>= V1.1.5.S0)


Firmwares published on Jun 7, 2019 or later are fixed.
Please refer to the corresponding manual. 

Reported by

These vulnerabilities were reported by T. Weber / SEC Consult Vulnerability Lab to CERT@VDE.