This week we have twelve vendor disclosures from Aruba, Carestream, Hitachi, WAGO, HMS, Philips, QNAP (5), and Tanzu. We have vendor updates from CODESYS and GE Healthcare. We have five researcher reports for products from Bosch. Finally, I would like to report that the bad links to Johnson Controls advisories that I noted (here and here) have been corrected.
Aruba Advisory
Aruba published an advisory describing thirteen vulnerabilities in their ClearPass Policy Manager. The vulnerabilities were reported variously by Erik De Jong, the Qualys Research Team, Or Cohen of Palo Alto Networks, Daniel Jensen, the Bell Canada security team, and damif512. Aruba has new versions that mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The 13 reported vulnerabilities are:
SQL injection - CVE-2021-34609,
Privilege escalation (2) - CVE-2021-3156 (exploit) and CVE-2020-14386,
Deserialization - CVE-2021-29150,
Remote command injection (7) - CVE-2021-34610, CVE-2021-34611, CVE-2021-34612, CVE-2021-34613, CVE-2021-34614, CVE-2021-34615, and CVE-2021-34616,
Authentication bypass - CVE-2021-29151, and
Denial of service - CVE-2021-29152,
Carestream Advisory
Carestream published an advisory [.PDF download link] discussing a third-party (Microsoft) HTTP Protocol Stack Remote Code Execution Vulnerability. The advisory lists affected Carestream affected products and recommends applying the Microsoft update.
Hitachi Advisory
Hitachi published an advisory describing an OS command injection vulnerability in their Virtual File Platform. The vulnerability was reported by Hiroki MATSUKUMA of Cyber Defense Institute, Inc. Hitachi has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
WAGO Advisory
CERT-VDE published an advisory describing four vulnerabilities in the WAGO I/O-Check Service. The vulnerabilities were reported by Uri Katz of Claroty. WAGO has a patch that mitigates the vulnerabilities. There is no indication that Katz has been provided an opportunity to verify the efficacy of the fix.
The four reported vulnerabilities are:
Shared memory buffer overflow - CVE-2021-34566,
Out-of-bounds read - CVE-2021-34567,
Allocation of resources without limits or throttling - CVE-2021-34568, and
Out-of-bounds write - CVE-2021-34569
HMS Advisory
HMS published an advisory discussing the FragAttacks WiFi vulnerabilities. The advisory provides a list of affected products. HMS continues to work on mitigation measures.
Philips Advisory
Philips published an advisory discussing the PrintNightmare vulnerabilities. Philips is looking into the problem to see if any of its products are affected.
NOTE: Philips is only talking about the second (latest) vulnerability in this advisory.
QNAP Advisories
QNAP published an advisory discussing the DNSpooq vulnerabilities. The advisory lists the affected products and the fixed versions of those products.
NOTE: I do not expect this advisory to be listed on the NCCIC-ICS DNSSpooq advisory.
QNAP published an advisory describing an XSS vulnerability in their QTS and QuTS hero products. The vulnerability was reported by Jakub Korepta. QNAP has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
QNAP published an advisory describing a Stored XSS vulnerability in their Q'center product. The vulnerability was reported by Jan Hoff. QNAP has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
QNAP published an advisory describing a Stored XSS vulnerability in their QuLog Center product. The vulnerability was reported by Jan Hoff. QNAP has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
QNAP published an advisory describing two command injection vulnerabilities in their QTS and QuTS hero products. The vulnerabilities were reported by Jan Hoff. QNAP has a new version that mitigates the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
Tanzu Advisory
Tanzu published an advisory describing an incorrect authorization vulnerability in their Spring Security OAuth 2.0 Client Web and WebFlux Application. The vulnerability was reported by Craig Andrews. Tanzu has new versions that mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
CODESYS Update
CODESYS published an update [.PDF download link] for their V2 web server advisory that was originally published on May 11th, 2021. The new information includes new version links and an interesting compatibility note that should be read by anyone using the V2 web server. It reads:
For compatibility reasons, starting from version V1.1.9.21 the CODESYS web server supports the new setting disable-secure-monitoring in webserver_conf.xml. This setting re-enables direct monitoring of var_inout variables of function blocks in addition to the usual monitoring of the caller variables. Since this setting weakens the security checks introduced to prevent CVE-2021-30194 attacks, CODESYS GmbH strongly recommends enabling this setting only if this feature is really needed by a specific CODESYS Webvisu application. Furthermore, enabling this setting requires a secure environment or appropriate compensation means.
This could have some interesting implications for third-party vendors using the V2 web server.
GE Healthcare Update
GE Healthcare published an update for the PACS vulnerability advisory that was originally published on December 18th, 2020. No new guidance, but because of new reports of internet facing systems, GE Healthcare wants to call attention to the generic security measures they recommend.
Bosch Reports
Kaspersky published five reports for vulnerabilities in the Bosch CPP HD/MP cameras. Bosch previously reported these vulnerabilities in a single advisory.