sca-2021-0004
Vulnerability from csaf_sick
Published
2021-12-16 08:00
Modified
2021-12-17 08:00
Summary
Vulnerabilities in SICK SOPAS ET

Notes

General Security Measures
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification
SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.
SICK received a report from Eden Bar of Claroty about multiple security vulnerabilities in the SICK SOPAS ET software. An unauthorized attacker could potentially craft a malicious SOPAS Device Driver (SDD) file, that if a user imports that file to SOPAS ET could allow arbitrary code execution on the target system. Currently SICK is not aware of any public exploits specifically targeting any of the vulnerabilities. SICK has released a new version of the SICK SOPAS ET software and recommends updating to the newest version.


To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Eden Bar"
        ],
        "organization": "Claroty"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      },
      {
        "category": "summary",
        "text": "SICK received a report from Eden Bar of Claroty about multiple security vulnerabilities in the SICK SOPAS ET software.\n\nAn unauthorized attacker could potentially craft a malicious SOPAS Device Driver (SDD) file, that if a user imports that file to SOPAS ET could allow arbitrary code execution on the target system.\n\nCurrently SICK is not aware of any public exploits specifically targeting any of the vulnerabilities. SICK has released a new version of the SICK SOPAS ET software and recommends updating to the newest version."
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
      "name": "SICK PSIRT",
      "namespace": "https://sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "http://ics-cert.us-cert.gov/content/recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2021/sca-2021-0004.json"
      }
    ],
    "title": "Vulnerabilities in SICK SOPAS ET",
    "tracking": {
      "current_release_date": "2021-12-17T08:00:00.000Z",
      "generator": {
        "date": "2023-02-10T07:46:51.595Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.0.0"
        }
      },
      "id": "SCA-2021-0004",
      "initial_release_date": "2021-12-16T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2021-12-17T08:00:00.000Z",
          "number": "1",
          "summary": "Initial Release"
        },
        {
          "date": "2023-02-10T11:00:00.000Z",
          "number": "2",
          "summary": "Updated Advisory (only visual changes)"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2021.4(4.8.0)",
                "product": {
                  "name": "SICK SOPAS Engineering Tool \u003c2021.4 (4.8.0)",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "x_generic_uris": [
                      {
                        "namespace": "SICK:Website",
                        "uri": "SICK:Website:https://www.sick.com/de/de/p/p367244"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "4.8.0",
                "product": {
                  "name": "SICK SOPAS Engineering Tool 4.8.0",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SOPAS Engineering Tool"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-32497",
      "cwe": {
        "id": "CWE-829",
        "name": "Inclusion of Functionality from Untrusted Control Sphere"
      },
      "notes": [
        {
          "category": "summary",
          "text": "SDD files might contain an executable file that will be listed as the Emulators inside SOPAS ET. When \na user starts the emulator, the executable is run without further checks. Attackers could wrap any \nexecutable file into an SDD and provide this to a SOPAS ET user. When installing the SDD the user \nmay not be aware about the executable inside of the SDD.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE Entry",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32497"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to at least version 4.8.0",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-32498",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When an SDD contains an emulator, the emulator location is part of the SDD manifest. Attackers could manipulate this location and use path traversal to target an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET, the corresponding executable will be started instead of the emulator."
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE Entry",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32498"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to at least version 4.8.0",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-32499",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The command line arguments that are passed to an emulator when starting it via SOPAS ET, are part \nof the SDD manifest. Attackers could manipulate the arguments to pass in any value to the \nexecutable. In combination with CVE-2021-32498 the attacker could target an arbitrary executable \nwith any arguments on the host system.\n"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE Entry",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32499"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to at least version 4.8.0",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.