Summary
A vulnerability was identified in the Automation License Manager software before V5.2 that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial of service preventing legitimate users from using the system.
Siemens has released a new version for Automation License Manager and recommends to update to the latest version.
Vulnerabilities 1
-
Unscored —
Memory leak in Siemens Automation License Manager (ALM) 4.x and 5.x before 5.2 allows remote attackers to cause a denia…
Revision history
-
#5
CISA Republication update based on Siemens ProductCERT SSA-783261 advisory
-
#4
Used CVE ID (CVE-2012-4691) instead of the deprecated SVE ID (SVE-2012-0001); Corrected CVSS vector; Updated SSA to current data model and support of csaf
-
#3
Advisory converted into a CSAF
-
#2
Publication Date
-
#1
Initial Publication
References
-
SSA-783261: Denial of Service Vulnerability in Automation License Manager (ALM) Before V5.2 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-783261.html
-
ICS Advisory ICSA-12-349-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-12-349-01
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b