Summary
WIBU Systems published information about a heap buffer overflow vulnerability and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products for license management.
The vulnerability is described in the section 'Vulnerability Classification' below and got assigned the CVE ID CVE-2023-3935.
Successful exploitation of this vulnerability could allow
- an unauthenticated remote attacker to execute code on vulnerable products, where CodeMeter Runtime (i.e., CodeMeter.exe) is configured as a server, or
- an authenticated local attacker to gain root/admin privileges on vulnerable products, where CodeMeter Runtime is configured as a client.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 1
-
Critical 9.8
Wibu: Buffer Overflow in CodeMeter Runtime
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
Revision history
-
#4
Added fix for SIMIT Simulation Platform
-
#3
Added fix for SINEC INS
-
#2
Added fix for PSS(R)E V35, SIMATIC WinCC OA V3.17 and SIMATIC WinCC OA V3.18; no fix planned for SIMATIC PCS neo V4.0
-
#1
Publication Date
References
-
SSA-240541: WIBU Systems CodeMeter Heap Buffer Overflow Vulnerability in Industrial Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-240541.html
-
SSA-240541: WIBU Systems CodeMeter Heap Buffer Overflow Vulnerability in Industrial Products - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-240541.pdf
-
SSA-240541: WIBU Systems CodeMeter Heap Buffer Overflow Vulnerability in Industrial Products - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-240541.txt