Summary
The latest update of the SCALANCE X-200 and X-300/X408 switches families fixes multiple OpenSSH vulnerabilities.
The most severe of these vulnerabilities could allow a denial of service condition.
Siemens has released updates for several affected products and recommends to update to the latest versions.
Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Vulnerabilities 3
-
High 7.5
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr…
-
Medium 6.2
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which mi…
-
Unscored —
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password …
Revision history
-
#3
Added fix for SCALANCE X-200IRT switch family
-
#2
Added solution for SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
-
#1
Publication Date
References
-
SSA-676336: OpenSSH Vulnerabilities in SCALANCE X-200 and X-300/X408 Switches - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-676336.html
-
SSA-676336: OpenSSH Vulnerabilities in SCALANCE X-200 and X-300/X408 Switches - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf
-
SSA-676336: OpenSSH Vulnerabilities in SCALANCE X-200 and X-300/X408 Switches - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-676336.txt