PT-2020-6603 · Codemeter · Codemeter

Published 2020-09-16 · Updated 2020-09-22 · CVE-2020-14515

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CodeMeter versions prior to 6.90

Description The issue is related to errors in the cryptographic signature checking mechanism of the CmActLicense component in the CodeMeter license control application. This allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. The exploitation of this issue may enable a remote attacker to rename arbitrary files.

Recommendations For versions prior to 6.90, update to version 6.90 or later to resolve the issue. As a temporary workaround, consider restricting the use of CmActLicense update files with CmActLicense Firm Code until a patch is available.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2022-00985

CVE-2020-14515

Affected Products

Codemeter

References · 5

• https://bdu.fstec.ru/vul/2022-00985 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-14515 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14515 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220222.2.pdf · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01 · Note