sca-2021-0002
Vulnerability from csaf_sick
Published
2021-08-04 10:00
Modified
2021-08-04 10:00
Summary
MEAC affected by Windows SMBv1 vulnerability

Notes

General Security Measures
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification
SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.
Microsoft disclosed a critical security vulnerability in the Microsoft Server Message Block 1.0 (SMBv1) back in 2017. A successful exploitation of this vulnerability could lead to remote code execution with administrator privileges.


To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      },
      {
        "category": "summary",
        "text": "Microsoft disclosed a critical security vulnerability in the Microsoft Server Message Block 1.0 (SMBv1) back in 2017. A successful exploitation of this vulnerability could lead to remote code execution with administrator privileges."
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
      "name": "SICK PSIRT",
      "namespace": "https://sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "http://ics-cert.us-cert.gov/content/recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2021/sca-2021-0002.json"
      }
    ],
    "title": "MEAC affected by Windows SMBv1 vulnerability",
    "tracking": {
      "aliases": [
        "WANNAMEAC"
      ],
      "current_release_date": "2021-08-04T10:00:00.000Z",
      "generator": {
        "date": "2023-02-10T07:29:43.825Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.0.0"
        }
      },
      "id": "SCA-2021-0002",
      "initial_release_date": "2021-08-04T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2021-08-04T10:00:00.000Z",
          "number": "1",
          "summary": "Initial Release"
        },
        {
          "date": "2023-02-10T11:00:00.000Z",
          "number": "2",
          "summary": "Updated Advisory (only visual changes)"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICK MEAC2012",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "MEAC2012"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2020-12-01T00:00:00+01:00",
                "product": {
                  "name": "SICK MEAC300 with sales date before December 2020",
                  "product_id": "CSAFPID-0002",
                  "product_identification_helper": {
                    "x_generic_uris": [
                      {
                        "namespace": "SICK:Website",
                        "uri": "SICK:Website:https://www.sick.com/de/de/p/p475070"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MEAC300"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-0144",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Microsoft disclosed a critical security vulnerability in the Microsoft Server Message Block 1.0 (SMBv1) back in 2017. \n\nSince the MEAC central emission monitoring computer (EPC) has enabled the affected SMBv1 protocol to support older versions of external NAS drives, the devices are affected by this vulnerability. To reduce the overall attack surface, in addition to applying the windows remediation, we recommend disabling SMBv1 as backwards compatibility is no longer required.\n\nA successful exploitation of this vulnerability could lead to remote code execution with administrator privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "We recommend disabling the SMBv1 protocol, as all current NAS drives support other protocols. Microsoft has published an article on how to disable SMBv1. This will help to protect the system from exploits of this vulnerability.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://docs.microsoft.com/en-US/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3"
        },
        {
          "category": "vendor_fix",
          "details": "This issue has been addressed in the Microsoft update for CVE-2017-0144.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0144"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.