Critical ICSA-18-093-01 8 CVEs

ICSA-18-093-01 Siemens Building Technologies Products (Update A)

Published Mar 28, 2018 · Updated Apr 3, 2018 · Revision 2

Vendor: Siemens Product: Annual Shading Product: Desigo ABT Product: Desigo CC Product: Desigo Configuration Manager (DCM) Product: Desigo XWP Product: License Management System (LMS) Product: SiteIQ Analytics Product: Siveillance Identity

Vulnerabilities 8

Unscored —

CVE-2017-11496

Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sent…

Oct 2, 2017
Unscored —

CVE-2017-11497

Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sent…

Oct 2, 2017
Unscored —

CVE-2017-11498

Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel L…

Oct 2, 2017
Unscored —

CVE-2017-12818

Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LD…

Gemalto Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE

Oct 3, 2017
Unscored —

CVE-2017-12819

Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentin…

Gemalto Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE

Oct 3, 2017
Unscored —

CVE-2017-12820

Arbitrary memory read from controlled memory pointer in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products pri…

Gemalto Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE

Oct 3, 2017
Unscored —

CVE-2017-12821

Memory corruption in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55…

Gemalto Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE

Oct 3, 2017
Unscored —

CVE-2017-12822

Remote enabling and disabling admin interface in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to S…

Gemalto Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE

Oct 3, 2017

Revision history

2018-04-03 #2
Added download link for LMU
2018-03-28 #1
Publication Date

References

SSA-727467: Vulnerabilities in Building Technologies Products
https://cert-portal.siemens.com/productcert/txt/ssa-727467.txt
ICSA Advisory ICSA-18-093-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-093-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B