PT-2012-5557 · Siemens · Rox Ii Os+2

Justin W. Clarke · Publicado 2012-12-23 · Atualizado 2013-05-21 · CVE-2012-4698

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens RuggedCom Rugged Operating System (ROS) versions prior to 3.12 ROX I OS versions prior to 1.14.6 ROX II OS versions prior to 2.3.1 RuggedMax OS versions prior to 4.2.1.4621.23

Description The issue allows man-in-the-middle attackers to spoof servers and decrypt network traffic by leveraging hardcoded private keys for SSL and SSH communication. These keys are available within ROS files at all customer installations.

Recommendations For Siemens RuggedCom Rugged Operating System (ROS) versions prior to 3.12, update to version 3.12 or later. For ROX I OS versions prior to 1.14.6, update to version 1.14.6 or later. For ROX II OS versions prior to 2.3.1, update to version 2.3.1 or later. For RuggedMax OS versions prior to 4.2.1.4621.23, update to version 4.2.1.4621.23 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-4698

Produtos afetados

Rox Ii Os

Ruggedmax Os

Siemens Ruggedcom Rugged Operating System

Referências · 5

• http://us-cert.gov/control_systems/pdf/ICSA-12-354-01.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4698 · Nota de Segurança
• https://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-622607.pdf · Aviso do Fabricante
• http://ics-cert.us-cert.gov/advisories/ICSA-12-354-01A · Nota
• http://ruggedcom.com/productbulletin/ros-security-page · Aviso do Fabricante