Share: Email | Twitter

ID

VDE-2019-013

Published

2019-06-12 12:25 (CEST)

Last update

2019-06-12 12:25 (CEST)

Vendor(s)

WAGO GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
852-1305 < V1.1.6.S0
852-1505 < V1.1.5.S0
852-303 < V1.2.2.S0

Summary

Multiple vulnerabilities have been identified in WAGO 852-303, 852-1305 and 852-1505 industrial managed ethernet switches.

Vulnerabilities



CVE-2015-0235
10.0
Last Update
Feb. 18, 2020, 9:27 a.m.
Severity
10.0 (CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
Details
nvd.nist.gov 
CVE-2014-9761
9.8
Last Update
Feb. 18, 2020, 9:23 a.m.
Severity
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.
Details
nvd.nist.gov 
CVE-2019-12549
9.8
Last Update
Feb. 18, 2020, 9:24 a.m.
Severity
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Use of Hard-coded Credentials (CWE-798)
Summary
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.
Details
nvd.nist.gov 
CVE-2016-2148
9.8
Last Update
Feb. 18, 2020, 9:23 a.m.
Severity
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.
Details
nvd.nist.gov 
CVE-2019-12550
9.8
Last Update
Feb. 18, 2020, 9:25 a.m.
Severity
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Use of Hard-coded Credentials (CWE-798)
Summary
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.
Details
nvd.nist.gov 
CVE-2014-9984
9.8
Last Update
Feb. 18, 2020, 9:23 a.m.
Severity
9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
Details
nvd.nist.gov 
CVE-2017-16544
8.8
Last Update
Feb. 18, 2020, 9:23 a.m.
Severity
8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Details
nvd.nist.gov 
CVE-2014-9402
7.8
Last Update
Feb. 18, 2020, 11:47 a.m.
Severity
7.8 (CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C)
Weakness
Resource Management Errors (CWE-399)
Summary
The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.
Details
nvd.nist.gov 
CVE-2015-1472
7.5
Last Update
Feb. 18, 2020, 11:58 a.m.
Severity
7.5 (CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary
The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call.
Details
nvd.nist.gov 
CVE-2016-6301
7.5
Last Update
Feb. 18, 2020, 8:42 a.m.
Severity
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness
Resource Management Errors (CWE-399)
Summary
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.
Details
nvd.nist.gov 
CVE-2011-5325
7.5
Last Update
Feb. 18, 2020, 9:23 a.m.
Severity
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary
Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.
Details
nvd.nist.gov 
CVE-2016-2147
7.5
Last Update
Feb. 18, 2020, 9:23 a.m.
Severity
7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness
Integer Overflow or Wraparound (CWE-190)
Summary
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.
Details
nvd.nist.gov 
CVE-2014-4043
7.5
Last Update
Feb. 18, 2020, 11:47 a.m.
Severity
7.5 (CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.
Details
nvd.nist.gov 
CVE-2012-4412
7.5
Last Update
Feb. 18, 2020, 11:46 a.m.
Severity
7.5 (CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness
Numeric Errors (CWE-189)
Summary
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow.
Details
nvd.nist.gov 
CVE-2010-0296
7.2
Last Update
Feb. 18, 2020, 11:33 a.m.
Severity
7.2 (CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness
Improper Input Validation (CWE-20)
Summary
The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request.
Details
nvd.nist.gov 
CVE-2013-1813
7.2
Last Update
Feb. 19, 2020, 8:52 a.m.
Severity
7.2 (CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness
Permissions, Privileges, and Access Controls (CWE-264)
Summary
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
Details
nvd.nist.gov 
CVE-2010-3856
7.2
Last Update
Feb. 18, 2020, 11:36 a.m.
Severity
7.2 (CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness
Permissions, Privileges, and Access Controls (CWE-264)
Summary
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.
Details
nvd.nist.gov 
CVE-2011-2716
6.8
Last Update
Feb. 18, 2020, 11:46 a.m.
Severity
6.8 (CVSS:2.0/AV:A/AC:H/Au:N/C:C/I:C/A:C)
Weakness
Improper Input Validation (CWE-20)
Summary
The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.
Details
nvd.nist.gov 
CVE-2015-9261
5.5
Last Update
Feb. 18, 2020, 9:23 a.m.
Severity
5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness
NULL Pointer Dereference (CWE-476)
Summary
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
Details
nvd.nist.gov 

Impact

(see cve details)

Solution

Update your managed switch to the latest firmware:

852-303 (>= V1.2.2.S0)
852-1305 (>= V1.1.6.S0)
852-1505 (>= V1.1.5.S0)


Firmwares published on Jun 7, 2019 or later are fixed.
Please refer to the corresponding manual. 

Reported by

These vulnerabilities were reported by T. Weber / SEC Consult Vulnerability Lab to CERT@VDE.