Phoenix Contact: WIBU-SYSTEMS CodeMeter Runtime vulnerabilities in multiple products

Impact
CVE-2023-38545
In a worst-case scenario and when using a SOCKS5 proxy, a successful exploitation of the vulnerability can lead to arbitrary code execution using the privileges of the user running the affected software.

CVE-2023-24540
WIBU Systems states that WIBU Codemeter is not affected by this vulnerability.

Mitigation
Disable using a SOCKS5 proxy:

The proxy environment variables HTTP_PROXY, HTTPS_PROXY and ALL_PROXYmust not be set to socks5h://

Ensure that CodeMeter is not defined to use the SOCKS5 proxy.

The variableProxyServer must not be start with socks5h://.

On Windows, the definition of that variable is in the registry (regedit) underHKLM/SOFTWARE/WIBU-SYSTEMS/CodeMeter/Server/CurrentVersion

On Mac, the definition of that variable is in the file/Library/Preferences/com.wibu.CodeMeter.Server.ini

On Linux, the definition of that variable is in the file/etc/wibu/CodeMeter/Server.ini

On Solaris, the definition of that variable is in the file/etc/opt/CodeMeter/Server.iniUse general security best practices to protect systems from local and network attacks likedescribed in the application node AH EN INDUSTRIAL SECURITY.

Remediation
PHOENIX CONTACT strongly recommends affected users to upgrade to CodeMeter V7.60d,which fixes these vulnerabilities. WIBU-SYSTEMS has already published an update forCodeMeter on their homepage. Since this current version of CodeMeter V7.60d has not yetbeen incorporated into Phoenix Contact products, we strongly recommend to download andinstall the current CodeMeter version directly from the WIBU-SYSTEMS homepage.Update Phoenix Contact Activation Wizard to version 1.7 when available. Please check the Phoenix Contact e-Shop for your related Software product regularly.