cnvd - cnvd-2024-38022

cnvd-2024-38022

Vulnerability from cnvd

Title: Siemens Automation License Manager拒绝服务漏洞

Description:

Siemens Automation License Manager是德国西门子（Siemens）公司的一款用于Siemens产品的许可证管理器。

Siemens Automation License Manager存在拒绝服务漏洞，该漏洞源于受影响的应用程序无法正确验证端口4410/tcp上传入网络数据包中的某些字段。攻击者可利用该漏洞导致整数溢出和应用程序崩溃。这种拒绝服务情况可能会阻止合法用户使用依赖受影响的应用程序进行许可证验证的后续产品。

Severity: 高

Patch Name: Siemens Automation License Manager拒绝服务漏洞的补丁

Patch Description:

Siemens Automation License Manager是德国西门子（Siemens）公司的一款用于Siemens产品的许可证管理器。

Siemens Automation License Manager存在拒绝服务漏洞，该漏洞源于受影响的应用程序无法正确验证端口4410/tcp上传入网络数据包中的某些字段。攻击者可利用该漏洞导致整数溢出和应用程序崩溃。这种拒绝服务情况可能会阻止合法用户使用依赖受影响的应用程序进行许可证验证的后续产品。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/html/ssa-103653.html

Reference: https://cert-portal.siemens.com/productcert/html/ssa-103653.html

Impacted products

Name
['Siemens Automation License Manager V6.2', 'Siemens Automation License Manager V6.0', 'Siemens Automation License Manager V5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-44087"
    }
  },
  "description": "Siemens Automation License Manager\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8eSiemens\u4ea7\u54c1\u7684\u8bb8\u53ef\u8bc1\u7ba1\u7406\u5668\u3002 \n\nSiemens Automation License Manager\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u65e0\u6cd5\u6b63\u786e\u9a8c\u8bc1\u7aef\u53e34410/tcp\u4e0a\u4f20\u5165\u7f51\u7edc\u6570\u636e\u5305\u4e2d\u7684\u67d0\u4e9b\u5b57\u6bb5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6574\u6570\u6ea2\u51fa\u548c\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u8fd9\u79cd\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\u53ef\u80fd\u4f1a\u963b\u6b62\u5408\u6cd5\u7528\u6237\u4f7f\u7528\u4f9d\u8d56\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u8fdb\u884c\u8bb8\u53ef\u8bc1\u9a8c\u8bc1\u7684\u540e\u7eed\u4ea7\u54c1\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-103653.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-38022",
  "openTime": "2024-09-12",
  "patchDescription": "Siemens Automation License Manager\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8eSiemens\u4ea7\u54c1\u7684\u8bb8\u53ef\u8bc1\u7ba1\u7406\u5668\u3002 \r\n\r\nSiemens Automation License Manager\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u65e0\u6cd5\u6b63\u786e\u9a8c\u8bc1\u7aef\u53e34410/tcp\u4e0a\u4f20\u5165\u7f51\u7edc\u6570\u636e\u5305\u4e2d\u7684\u67d0\u4e9b\u5b57\u6bb5\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6574\u6570\u6ea2\u51fa\u548c\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u3002\u8fd9\u79cd\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\u53ef\u80fd\u4f1a\u963b\u6b62\u5408\u6cd5\u7528\u6237\u4f7f\u7528\u4f9d\u8d56\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u8fdb\u884c\u8bb8\u53ef\u8bc1\u9a8c\u8bc1\u7684\u540e\u7eed\u4ea7\u54c1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens Automation License Manager\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens Automation License Manager V6.2",
      "Siemens Automation License Manager V6.0",
      "Siemens Automation License Manager V5"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-103653.html",
  "serverity": "\u9ad8",
  "submitTime": "2024-09-12",
  "title": "Siemens Automation License Manager\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2024-44087 (GCVE-0-2024-44087)

Vulnerability from cvelistv5

Published

2024-09-10 09:36

Modified

2025-05-13 09:38

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
9.2 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CWE

CWE-190 - Integer Overflow or Wraparound

Summary

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-103653.html

Impacted products

Vendor

Product

Version

▼

Siemens

Automation License Manager V5

Version: 0 < *

	Siemens	Automation License Manager V6.0	Version: 0 < V6.0 SP12 Upd3
	Siemens	Automation License Manager V6.2	Version: 0 < V6.2 Upd3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:siemens:automation_license_manager:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "automation_license_manager",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "6.2_upd3",
                "status": "affected",
                "version": "5.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T14:32:51.431922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T14:37:47.616Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Automation License Manager V5",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Automation License Manager V6.0",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V6.0 SP12 Upd3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "Automation License Manager V6.2",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V6.2 Upd3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions \u003c V6.0 SP12 Upd3), Automation License Manager V6.2 (All versions \u003c V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-13T09:38:13.760Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-103653.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-44087",
    "datePublished": "2024-09-10T09:36:52.341Z",
    "dateReserved": "2024-08-19T09:15:40.500Z",
    "dateUpdated": "2025-05-13T09:38:13.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted