Share: Email | Twitter

ID

VDE-2024-044

Published

2024-07-31 10:00 (CEST)

Last update

2024-07-30 14:36 (CEST)

Vendor(s)

Helmholz GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
myREX24 V2 < 2.16.1
myREX24 V2 virtual < 2.16.1
REX200 8.0.0 < 8.2.0
REX250 8.0.0 < 8.2.0

Summary

Several Helmholz products are vulnerable to a possible race condition vulnerability in OpenSSH named "regreSSHion".


Last Update:

Aug. 30, 2024, 9:21 a.m.

Weakness

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')  (CWE-362) 

Summary

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.


Impact

Possible full system compromise where an attacker can execute arbitrary code with the highest privileges.

Solution

Mitigation

Prevent all access to the sshd daemon listening on port 22.

Remediation

Update to latest firmware:

  • 2.16.1 for myREX24 V2/myREX24 V2 virtual
  • 8.2.0 for REX200/REX250

Reported by

CERT@VDE coordinated with Helmholz