PT-2023-6875 · Comos · Comos

Published 2023-11-14 · Updated 2023-11-18 · CVE-2023-43504

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions COMOS versions prior to V10.4.4

Description A vulnerability has been identified in the ptmcast executable used for testing cache validation service in the affected application. This vulnerability is related to a buffer overflow and could allow an attacker to execute arbitrary code on the target system or cause a denial of service condition. The issue is also associated with uncontrolled copying of data, potentially impacting data confidentiality and integrity.

Recommendations For versions prior to V10.4.4, update to version V10.4.4 or later to resolve the issue. As a temporary workaround, consider disabling the ptmcast executable until a patch is available. Restrict access to the cache validation service to minimize the risk of exploitation. Avoid using the affected application for sensitive operations until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-07890

CVE-2023-43504

Affected Products

Comos

References · 8

• https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43504 · Security Note
• https://bdu.fstec.ru/vul/2023-07890 · Security Note
• https://twitter.com/CVEnew/status/1724387637258023082 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1724428548675354949 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-137900.html · Note
• https://twitter.com/vuldb/status/1724422320687603781 · Twitter Post