PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management

Impact
Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles ('ATV profiles'). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.

Mitigation
Stop the ApacheMDM Windows service.

Edit file <mdm>/apache/conf/extra/httpd-mdm.conf and remove the instances of these lines for 'DocumentRoot' and alias '/atv':

#Controls who can get stuff from this server.

Require all granted

<mdm> refers to the directory in which FL MGUARD DM is installed.

Start the ApacheMDM Windows service.

Remediation
This vulnerability is fixed in FL MGUARD DM 1.13.0.1. We advise all affected FL MGUARD DM 1.12.0 and 1.13.0 users to upgrade to FL MGUARD DM 1.13.0.1 or a later version.
Additional recommendations:

- Limit network access to the Apache web server to as few network addresses as possible.
- If possible, make use of encrypted mGuard configuration profiles.