Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Serious Flaws in WibuKey DRM Impact Siemens Products

Siemens has informed customers that some of its products are affected by recently disclosed vulnerabilities affecting the WibuKey digital rights management (DRM) solution from Wibu Systems.

Siemens has informed customers that some of its products are affected by recently disclosed vulnerabilities affecting the WibuKey digital rights management (DRM) solution from Wibu Systems.

Cisco Talos revealed in December that the WibuKey DRM has three vulnerabilities that can lead to information disclosure, privilege escalation, and remote code execution. Cisco noted at the time that WibuKey is used by many applications, including the V-Ray image rendering software, the ArchiCAD architectural design software, and the Straton industrial automation software.

It turns out that Siemens also uses WibuKey for some of its products, including SICAM 230, a process control and monitoring system designed for the energy sector, and the SIMATIC WinCC Open Architecture (OA) human-machine interface (HMI) product.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

The most serious of the WibuKey flaws is CVE-2018-3991, a critical heap overflow that can be exploited by a remote attacker for arbitrary code execution by sending specially crafted TCP packets to the targeted system on port 22347.

Another critical vulnerability is CVE-2018-3990, a pool corruption that can be exploited to escalate privileges by sending specially crafted I/O request packets (IRPs).

The last vulnerability is CVE-2018-3989, which can also be exploited via specially crafted IRP requests. This security hole can allow an attacker to read kernel memory information and it has been assigned a severity rating of “medium.”

Siemens has advised customers to update the WibuKey DRM to version 6.50 or higher, which should patch the vulnerabilities. The German industrial giant also recommends blocking port 22347 via a firewall to prevent exploitation of CVE-2018-3991.

Cisco has published technical information for each of the vulnerabilities, along with proof-of-concept (PoC) exploits, which increases the chances of exploitation.

Related: Siemens Wants to Release Security Advisories on Patch Tuesday

Related: Siemens Warns of Linux, GNU Flaws in Controller Platform

Related: Siemens Patches Several Critical Flaws in SINUMERIK Controllers

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

ICS/OT

Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.