A busy week with lots of SpringShell and DirtyPipe disclosures, so there will be two parts this week. In this part we have 24 vendor disclosures from Aruba, Barco, Bentley (8), Braun, Broadcom (3), Carrier, Weidmueller, WAGO, CODESYS (6), and FANUC.
Aruba Advisory
Aruba published an advisory discussing the SpringShell vulnerabilities. Aruba provides a list of unaffected products.
Barco Advisory
Barco published an advisory discussing the DirtyPipe vulnerability. Barco provides a list of unaffected products.
Bentley Advisories
Bentley published an advisory describing two use after free vulnerabilities in the Bentley MicroStation and MicroStation-based applications. The vulnerability was reported by Mat Powell via the Zero Day Initiative. Bentley has new versions that mitigate the vulnerability. There is no indication that Powell has been provided an opportunity to verify the efficacy of the fix.
Bentley published an advisory describing three stack-based buffer overflow vulnerabilities in the Bentley MicroStation and MicroStation-based applications. The vulnerabilities were reported by Mat Powell via ZDI. Bentley has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Bentley published an advisory describing an out-of-bounds write vulnerability in the Bentley MicroStation and MicroStation-based applications. The vulnerabilities were reported by Mat Powell via ZDI. Bentley has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Bentley published an advisory describing eleven file parsing vulnerabilities in the Bentley MicroStation and MicroStation-based applications. The vulnerabilities were reported by Mat Powell via ZDI. Bentley has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Bentley published an advisory describing two out-of-bounds read vulnerabilities in the Bentley MicroStation and MicroStation-based applications. The vulnerabilities were reported by Mat Powell via ZDI. Bentley has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Bentley published an advisory describing five out-of-bounds vulnerabilities in the Bentley MicroStation and MicroStation-based applications. The vulnerabilities were reported by Mat Powell via ZDI. Bentley has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Bentley published an advisory describing four out-of-bounds read vulnerabilities in the Bentley MicroStation and MicroStation-based applications. The vulnerabilities were reported by Mat Powell via ZDI. Bentley has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Bentley published an advisory describing two unitialized variable vulnerabilities vulnerabilities in the Bentley MicroStation and MicroStation-based applications. The vulnerabilities were reported by Mat Powell via ZDI. Bentley has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Braun Advisory
Braun published an advisory discussing the Infusion Pump Vulnerabilities article by Palo Alto Networks. Braun reports that none of their products are affected.
Broadcom Advisories
Broadcom published an advisory discussing one of the SpringShell vulnerabilities. Broadcom reports that none of their products are affected.
Broadcom published an advisory discussing the other SpringShell vulnerability. Broadcom reports that none of their products are affected.
Broadcom published an advisory discussing an older Spring Framework vulnerability reanimated by the SpringShell vulnerability. Broadcom reports that none of their products are affected.
Carrier Advisory
Carrier published an advisory discussing the SpringShell vulnerabilities. Carrier is conducting their initial investigation.
Weidmueller Advisory
CERT-VDE published an advisory discussing nine vulnerabilities in two products using Modbus TCP/RTU Gateways. These are third-party (Moxa) vulnerabilities. Weidmueller has new firmware versions that mitigate the vulnerabilities.
The nine reported vulnerabilities are:
Weak password requirements - CVE-2019-9096,
Use of broken or risky cryptographic algorithm - CVE-2019-9095,
Classic buffer overflow - CVE-2019-9099,
Use of insufficiently random variables - CVE-2019-9102,
Cleartext transmission of sensitive information (2) - CVE-2019-9101 and CVE-2019-9104,
Integer overflow or wraparound - CVE-2019-9098,
Race condition - CVE-2019-9097, and
Exposure of sensitive information to an unauthorized actor - CVE-2019-9103
WAGO Advisory
CERT-VDE published an advisory discussing the DirtyPipe vulnerability in several WAGO products. WAGO has new firmware versions that mitigate the vulnerabilities.
CODESYS Advisories
CODESYS published an advisory describing an exposure of resource to wrong sphere vulnerability in the CODESYS Control V3 products. The vulnerability was reported by Uri Katz of Claroty. CODESYS has new versions that mitigate the vulnerability. There is no indication that Katz has been provided an opportunity to verify the efficacy of the fix.
CODESYS published an advisory describing an incorrect permission assignment for a critical resource vulnerability in the CODESYS SysDrv3S.sys driver. The vulnerability was reported by Denis Goryushev of Positive Technologies. CODESYS has new versions and updates that mitigate the vulnerability. There is no indication that Goryushey has been provided an opportunity to verify the efficacy of the fix.
CODESYS published an advisory describing a small space of random values vulnerability in CODESYS V3 products using the CODESYS communication protocol. The vulnerability was reported by B. Fels and B. Stuber of Robert Bosch GmbH. CODESYS has new versions that mitigate the vulnerability in some of the affected products. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
CODESYS published an advisory describing an incorrect user management vulnerability in the CODESYS Control V3 online user management applications. CODESYS has new versions that mitigate the vulnerability in some of the affected products.
CODESYS published an advisory describing two vulnerabilities in CODESYS V3 products containing a CODESYS communication server. One of the vulnerabilities was reported by icsbob. CODESYS has new versions that mitigate the vulnerability in some of the affected products. There is no indication icsbob has been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Null pointer dereference - CVE-2022-22513, and
Untrusted pointer dereference - CVE-2022-22514
CODESYS published an advisory describing a buffer over read vulnerability in the CODESYS V3 web server. The vulnerability was reported by an unnamed OEM customer. CODESYS has new versions that mitigate the vulnerability in some of the affected products. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
FANUC Advisory
FANUC published an advisory describing five vulnerabilities in their ROBOGUIDE product. FANUC has a new version that mitigates the vulnerabilities.
The five reported vulnerabilities are:
CVE-2019-43933,
CVE-2019-43988,
CVE-2019-43990,
CVE-2021-38483, and
CVE-2-21-43986