Multiple vulnerabilities in Siemens

Beschreibung

Multiple critical vulnerabilities have been found in Siemens products. Malicious users can exploit these vulnerabilities to read & modify arbitrary files, cause denial of service, execute arbitrary code, bypass authentication, obtain access and inject arbitrary HTTP headers. Below is a complete list of vulnerabilities

1. A directory traversal vulnerability can be exploited remotely via a specially designed request;
2. Vectors related to HmiLoad can be exploited remotely via specially designed TCP data;
3. A buffer overflow can be exploited remotely via vectors related to unicode strings;
4. Improper URI handling can be exploited remotely via a specially designed POST request;
5. Predictable auth tokens can be exploited remotely via specially designed cookies;
6. Weak default passwords can be exploited remotely via brute-force;
7. Lack of authentication in the TELNET daemon can be exploited remotely via TCP sessions;
8. An XSS vulnerability can be exploited remotely;
9. Vectors related to the HMI web-server and runtime loader can be exploited remotely;
10. A CRLF vulnerability can be exploited remotely.

Ursprüngliche Informationshinweise

• Siemens bulletin

CVE Liste

• CVE-2011-4878
  critical
• CVE-2011-4875
  critical
• CVE-2011-4877
  critical
• CVE-2011-4876
  critical
• CVE-2011-4508
  critical
• CVE-2011-4879
  critical
• CVE-2011-4510
  critical
• CVE-2011-4511
  critical
• CVE-2011-4514
  critical
• CVE-2011-4509
  critical
• CVE-2011-4512
  critical
• CVE-2011-4513
  critical

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com