检测
分析学
西门斯工业产品OpenSSL脆弱性
高位可租OT安全插件ID 500473
简表
远程OT资产受脆弱性影响描述性
OpenSSL前为0.98ZA前为1.0.0m前为1.0.1,1.0.1h前不适当限制 ChangeCifferSpec消息处理,该消息允许中位攻击者触发使用OpenSSL对OpenSSL通信中的0长主键,并随后通过编译TLS握手获取敏感信息插件只对Tenable.ot工作
网站s/www.yyueer.com/products/tenable-ot获取更多信息
求解
下文原由网络安全基础设施安全局创建原创可见于CISA.govRockwell自动化提供新固件版本15.6.3版,以减轻这些漏洞
Rockwell自动化鼓励受影响版本用户更新最新软件版本解决相关风险,并包括提高软件强度并增强对类似恶意攻击的应变能力用户可通过以下网站搜索最新固件版本
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=15
Rockwell自动化安全发布推荐针对这类攻击的额外防范和减少风险策略在可能的情况下,多项策略应同时实施
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1041191
另请参考Cisco安全建议(下文链接)补充工作变通办法和漏洞细节
并见
http://www.openssl.org/news/secadv_20140605.txt
http://ccsinjection.lepidum.co.jp
http://secunia.com/advisories/59413
http://www-01.ibm.com/support/docview.wss?uid=swg24037761
http://www.nessus.org/u?6b98b564
http://www-01.ibm.com/support/docview.wss?uid=swg21677390
http://secunia.com/advisories/59300
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004690
http://secunia.com/advisories/59383
http://www.splunk.com/view/SP-CAAAM2D
https://discussions.nessus.org/thread/7517
http://secunia.com/advisories/59885
http://www.nessus.org/u?46b88aa1
http://www.nessus.org/u?7de2f8eb
http://secunia.com/advisories/59459
http://secunia.com/advisories/58745
http://secunia.com/advisories/59530
http://secunia.com/advisories/59589
http://secunia.com/advisories/59451
http://www-01.ibm.com/support/docview.wss?uid=isg400001843
http://www.fortiguard.com/advisory/FG-IR-14-018/
http://secunia.com/advisories/59506
https://filezilla-project.org/versions.php?type=server
http://www-01.ibm.com/support/docview.wss?uid=isg400001841
http://secunia.com/advisories/59894
http://secunia.com/advisories/60049
http://www.nessus.org/u?3014ab34
http://secunia.com/advisories/58743
http://secunia.com/advisories/59342
http://secunia.com/advisories/59325
http://secunia.com/advisories/59354
http://marc.info/?l=bugtraq&m=140904544427729&w=2
http://marc.info/?l=bugtraq&m=140389355508263&w=2
http://marc.info/?l=bugtraq&m=140752315422991&w=2
http://marc.info/?l=bugtraq&m=140794476212181&w=2
http://www.nessus.org/u?3818101e
http://www.nessus.org/u?bac902d5
http://www.nessus.org/u?e6ea11ce
http://www.nessus.org/u?e062d049
https://www.novell.com/support/kb/doc.php?id=7015271
https://www.ibm.com/support/docview.wss?uid=ssg1S1004671
https://www.ibm.com/support/docview.wss?uid=ssg1S1004670
http://www.nessus.org/u?f997f6c0
http://www.nessus.org/u?957ff7ff
http://www.nessus.org/u?87b3d108
http://www.nessus.org/u?eb9f4c47
http://www.nessus.org/u?c603c39c
http://www-01.ibm.com/support/docview.wss?uid=swg24037870
http://www-01.ibm.com/support/docview.wss?uid=swg24037732
http://www-01.ibm.com/support/docview.wss?uid=swg24037731
http://www-01.ibm.com/support/docview.wss?uid=swg24037730
http://www-01.ibm.com/support/docview.wss?uid=swg24037729
http://www-01.ibm.com/support/docview.wss?uid=swg24037727
http://www-01.ibm.com/support/docview.wss?uid=swg21683332
http://www-01.ibm.com/support/docview.wss?uid=swg21678233
http://www-01.ibm.com/support/docview.wss?uid=swg21677836
http://www-01.ibm.com/support/docview.wss?uid=swg21677131
http://www-01.ibm.com/support/docview.wss?uid=swg21677080
http://www-01.ibm.com/support/docview.wss?uid=swg21676889
http://www-01.ibm.com/support/docview.wss?uid=swg21676879
http://www-01.ibm.com/support/docview.wss?uid=swg21676833
http://www-01.ibm.com/support/docview.wss?uid=swg21676786
http://www-01.ibm.com/support/docview.wss?uid=swg21676644
http://www-01.ibm.com/support/docview.wss?uid=swg21676615
http://www-01.ibm.com/support/docview.wss?uid=swg21676536
http://www-01.ibm.com/support/docview.wss?uid=swg21676529
http://www-01.ibm.com/support/docview.wss?uid=swg21676501
http://www-01.ibm.com/support/docview.wss?uid=swg21676478
http://www-01.ibm.com/support/docview.wss?uid=swg21676334
http://www-01.ibm.com/support/docview.wss?uid=swg21676333
http://www-01.ibm.com/support/docview.wss?uid=swg21676071
http://www-01.ibm.com/support/docview.wss?uid=swg21675821
http://www-01.ibm.com/support/docview.wss?uid=swg21675626
http://www-01.ibm.com/support/docview.wss?uid=swg1IV61506
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020163
http://www.vmware.com/security/advisories/VMSA-2014-0006.html
http://www.mandriva.com/security/advisories?name=MDVSA-2014:106
http://www.mandriva.com/security/advisories?name=MDVSA-2014:105
http://www.nessus.org/u?bc543587
http://www.ibm.com/support/docview.wss?uid=swg24037783
http://www.ibm.com/support/docview.wss?uid=swg21676877
http://www.ibm.com/support/docview.wss?uid=swg21676793
http://www.ibm.com/support/docview.wss?uid=swg21676356
http://www.ibm.com/support/docview.wss?uid=swg1IT02314
http://www.ibm.com/support/docview.wss?uid=ssg1S1004678
http://www.ibm.com/support/docview.wss?uid=isg3T1020948
http://secunia.com/advisories/59093
http://secunia.com/advisories/59040
http://secunia.com/advisories/59004
http://secunia.com/advisories/58977
http://secunia.com/advisories/58945
http://secunia.com/advisories/58742
http://secunia.com/advisories/58719
http://secunia.com/advisories/58716
http://secunia.com/advisories/58714
http://secunia.com/advisories/58713
http://secunia.com/advisories/58667
http://secunia.com/advisories/58660
http://secunia.com/advisories/58615
http://secunia.com/advisories/58492
http://secunia.com/advisories/58433
http://secunia.com/advisories/58337
http://seclists.org/fulldisclosure/2014/Jun/38
http://www.nessus.org/u?f68d352b
http://www.nessus.org/u?c49877be
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
http://www.nessus.org/u?76f5def7
http://www.nessus.org/u?1e07fa0e
http://www.securityfocus.com/archive/1/534161/100/0/threaded
http://www.kb.cert.org/vuls/id/978508
https://bugzilla.redhat.com/show_bug.cgi?id=1103586
http://www.nessus.org/u?c19c03e5
https://www.imperialviolet.org/2014/06/05/earlyccs.html
https://access.redhat.com/site/blogs/766093/posts/908133
http://secunia.com/advisories/59191
http://secunia.com/advisories/58579
https://kb.bluecoat.com/index?page=content&id=SA80
http://www.nessus.org/u?5539aa9d
http://www.kerio.com/support/kerio-control/release-history
http://secunia.com/advisories/59438
http://www-01.ibm.com/support/docview.wss?uid=swg21676035
http://secunia.com/advisories/59301
http://secunia.com/advisories/59721
http://secunia.com/advisories/59491
http://secunia.com/advisories/59450
http://www-01.ibm.com/support/docview.wss?uid=swg21676845
http://secunia.com/advisories/59655
http://www-01.ibm.com/support/docview.wss?uid=swg21677695
http://secunia.com/advisories/59659
http://secunia.com/advisories/58639
http://www.nessus.org/u?d68c75da
http://secunia.com/advisories/58759
http://www-01.ibm.com/support/docview.wss?uid=swg21678289
http://secunia.com/advisories/59043
http://secunia.com/advisories/59666
http://secunia.com/advisories/59126
http://www.nessus.org/u?25e3d768
http://marc.info/?l=bugtraq&m=140499864129699&w=2
http://www-01.ibm.com/support/docview.wss?uid=swg21677567
http://secunia.com/advisories/59055
http://secunia.com/advisories/59490
http://www-01.ibm.com/support/docview.wss?uid=swg21676419
http://www.nessus.org/u?23273edc
http://www.novell.com/support/kb/doc.php?id=7015300
http://www.nessus.org/u?2115f75f
http://www-01.ibm.com/support/docview.wss?uid=swg21673137
http://secunia.com/advisories/59514
http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html
http://secunia.com/advisories/59602
http://secunia.com/advisories/59495
http://www.novell.com/support/kb/doc.php?id=7015264
http://esupport.trendmicro.com/solution/en-US/1103813.aspx
http://secunia.com/advisories/58930
http://secunia.com/advisories/59370
http://secunia.com/advisories/59012
http://www.blackberry.com/btsc/KB36051
http://secunia.com/advisories/58385
http://www-01.ibm.com/support/docview.wss?uid=swg21676655
http://secunia.com/advisories/59120
http://secunia.com/advisories/59162
http://secunia.com/advisories/58939
http://secunia.com/advisories/59528
http://secunia.com/advisories/59063
http://www-01.ibm.com/support/docview.wss?uid=swg21677828
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020172
http://secunia.com/advisories/58128
http://www-01.ibm.com/support/docview.wss?uid=swg21676062
https://kc.mcafee.com/corporate/index?page=content&id=SB10075
https://www.cisa.gov/news-events/ics-advisories/icsa-17-094-04
http://www-01.ibm.com/support/docview.wss?uid=swg21676496
http://www-01.ibm.com/support/docview.wss?uid=swg21678167
http://secunia.com/advisories/59442
http://secunia.com/advisories/59824
http://www.nessus.org/u?2a8d3d74
http://www-01.ibm.com/support/docview.wss?uid=swg21677527
http://www.nessus.org/u?d8f6abfb
http://secunia.com/advisories/59827
http://secunia.com/advisories/59669
http://secunia.com/advisories/59916
http://rhn.redhat.com/errata/RHSA-2014-0624.html
http://marc.info/?l=bugtraq&m=140386311427810&w=2
http://rhn.redhat.com/errata/RHSA-2014-0631.html
http://rhn.redhat.com/errata/RHSA-2014-0632.html
http://rhn.redhat.com/errata/RHSA-2014-0630.html
http://rhn.redhat.com/errata/RHSA-2014-0627.html
http://marc.info/?l=bugtraq&m=140369637402535&w=2
http://rhn.redhat.com/errata/RHSA-2014-0680.html
http://rhn.redhat.com/errata/RHSA-2014-0633.html
http://rhn.redhat.com/errata/RHSA-2014-0626.html
http://secunia.com/advisories/60066
http://puppetlabs.com/security/cve/cve-2014-0224
http://secunia.com/advisories/59990
http://secunia.com/advisories/60522
http://linux.oracle.com/errata/ELSA-2014-1053.html
http://secunia.com/advisories/60577
http://secunia.com/advisories/59784
http://secunia.com/advisories/59878
http://secunia.com/advisories/60176
http://secunia.com/advisories/60567
http://secunia.com/advisories/60571
http://secunia.com/advisories/60819
http://support.apple.com/kb/HT6443
http://www.nessus.org/u?6dcc7b47
http://marc.info/?l=bugtraq&m=141164638606214&w=2
http://marc.info/?l=bugtraq&m=141383465822787&w=2
http://marc.info/?l=bugtraq&m=141025641601169&w=2
http://marc.info/?l=bugtraq&m=141383410222440&w=2
http://marc.info/?l=bugtraq&m=141147110427269&w=2
http://marc.info/?l=bugtraq&m=140983229106599&w=2
http://secunia.com/advisories/61815
http://www.securitytracker.com/id/1031032
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
http://seclists.org/fulldisclosure/2014/Dec/23
http://www.nessus.org/u?c02f1515
http://www.securitytracker.com/id/1031594
http://marc.info/?l=bugtraq&m=142546741516006&w=2
http://marc.info/?l=bugtraq&m=142350350616251&w=2
http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html
http://www.nessus.org/u?acb4a410
http://www.nessus.org/u?c46d757d
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
http://marc.info/?l=bugtraq&m=142805027510172&w=2
http://www.nessus.org/u?453b5f8c
http://marc.info/?l=bugtraq&m=141658880509699&w=2
http://marc.info/?l=bugtraq&m=140448122410568&w=2
http://marc.info/?l=bugtraq&m=140491231331543&w=2
http://marc.info/?l=bugtraq&m=140621259019789&w=2
http://marc.info/?l=bugtraq&m=140482916501310&w=2
http://marc.info/?l=bugtraq&m=140870499402361&w=2
http://marc.info/?l=bugtraq&m=140784085708882&w=2
http://marc.info/?l=bugtraq&m=140852826008699&w=2
http://marc.info/?l=bugtraq&m=140604261522465&w=2
http://marc.info/?l=bugtraq&m=140431828824371&w=2
http://marc.info/?l=bugtraq&m=140266410314613&w=2
http://marc.info/?l=bugtraq&m=140852757108392&w=2
http://marc.info/?l=bugtraq&m=140544599631400&w=2
http://marc.info/?l=bugtraq&m=140389274407904&w=2
http://marc.info/?l=bugtraq&m=140672208601650&w=2
http://marc.info/?l=bugtraq&m=140317760000786&w=2
http://www.f-secure.com/en/web/labs_global/fsc-2014-6
http://www.nessus.org/u?91a242c9
http://support.citrix.com/article/CTX140876
http://security.gentoo.org/glsa/glsa-201407-05.xml
http://secunia.com/advisories/61254
http://secunia.com/advisories/59677
http://secunia.com/advisories/59661
http://secunia.com/advisories/59529
http://secunia.com/advisories/59525
http://secunia.com/advisories/59518
http://secunia.com/advisories/59502
http://secunia.com/advisories/59483
http://secunia.com/advisories/59460
http://secunia.com/advisories/59454
http://secunia.com/advisories/59449
http://secunia.com/advisories/59448
http://secunia.com/advisories/59447
http://secunia.com/advisories/59446
http://secunia.com/advisories/59445
http://secunia.com/advisories/59444
http://secunia.com/advisories/59441
http://secunia.com/advisories/59440
http://secunia.com/advisories/59437
http://secunia.com/advisories/59435
http://secunia.com/advisories/59429
http://secunia.com/advisories/59389
http://secunia.com/advisories/59380
http://secunia.com/advisories/59375
http://secunia.com/advisories/59374
http://secunia.com/advisories/59368
http://secunia.com/advisories/59365
http://secunia.com/advisories/59364
http://secunia.com/advisories/59362
http://secunia.com/advisories/59347
http://secunia.com/advisories/59338
http://secunia.com/advisories/59310
http://secunia.com/advisories/59306
http://secunia.com/advisories/59305
http://secunia.com/advisories/59287
http://secunia.com/advisories/59284
http://secunia.com/advisories/59282
http://secunia.com/advisories/59264
http://secunia.com/advisories/59231
http://secunia.com/advisories/59223
http://secunia.com/advisories/59215
http://secunia.com/advisories/59214
http://secunia.com/advisories/59211
http://secunia.com/advisories/59202
http://secunia.com/advisories/59192
http://secunia.com/advisories/59190
http://secunia.com/advisories/59189
http://secunia.com/advisories/59188
http://secunia.com/advisories/59186
http://secunia.com/advisories/59175
http://secunia.com/advisories/59167
http://secunia.com/advisories/59163
http://secunia.com/advisories/59142
http://secunia.com/advisories/59135
http://secunia.com/advisories/59132
https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf
插件细节
严重性 :高位
身份证 :500473
版本化 :1.6
类型 :远程
家庭问题 :可调用.ot
发布 :2/7/2022
更新 :8/24/2023
风险信息
VPR
风险因子 :高位
分数 :8.3
CVSS v2
风险因子 :中度
基础评分 :5.8
向量 :CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS评分源 :CVE-2014-0224
CVSSv3
风险因子 :高位
基础评分 :7.4
向量 :CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
漏洞信息
CPE系统 :cpe:/o:siemens:cp1543-1_firmware,cpe:/o:siemens:s7-1500_firmware
需要kb项 :Tenable.ot/Siemens
开发易斯 :无已知利用
补丁发布日期 :2014年5月6日
漏洞发布日期 :2014年5月6日
参考信息
CVE系统 :CVE-2014-0224
CWE系统 :326
费多拉 :FEDORA-2014-9301,FEDORA-2014-9308
GLSA :GLSA-201407-05
HP :HPSBGN030,HPSBGN03068,HPSBHV03052,HPSBHV038,HPSBHV03145,HPSBMU03051,HPSBMU03053,HPSBMU03055,HPSBMU03056,HPSBMU03057,HPSBMU03058,HPSBMU03062,HPSBMU03065,HPSBMU03070,HPSBMU03071,HPSBMU03074,HPSBMU03076,HPSBMU03078,HPSBMU03083,HPSBMU03089,HPSBMU03094,HPSBMU03101,HPSBOV03047,HPSBI03107,HPSBST03097,HPSBST03098,HPSBST03103,HPSBST0106,HPSBST195,HPSBST265,HPSBUX03046,SERT1018
RHSA :RHSA-2014:0624,RHSA-2014:0626,RHSA-2014:0627,RHSA-2014:0630,RHSA-2014:0631,RHSA-2014:0632,RHSA-2014:0633,RHSA-2014:0680
SECUNIA系统 :58128,58337,58385,58433,58492,58579,58615,58639,58660,58667,58713,58714,58716,58719,58742,58743,58745,58759,58930,58939,58945,58977,59004,59012,59040,59043,59055,59063,59093,59101,59120,59126,59132,59135,59142,59162,59163,59167,59175,59186,5918,59189,59190,59191,59192,59202,59211,59214,59215,59223,59231,59264,59282,59284,59287,59300,59301,59305,59306,59310,59325,59338,59342,59347,59354,59362,59364,59365,59368,59370,59374,59375,59380,59383,59389,59413,59429,59435,59437,59438,59440,5944,59442,59444,59445,59446,59447,59448,59449,59450,59451,59454,59459,59460,59483,59490,59491,59495,59502,59506,59514,59518,59525,59528,59529,59530,59589,59602,59655,59659,5966,5966,59669,59677,59721,59784,59824,59827,59878,59885,59894,59916,59990,60049,60066,60176,60522,60567,60571,60577,60819,61254,61815
SOSE系统 :SUSE-SU-2015:0578,SUSE-SU-2015:0743,openSUSE-SU-2015:0229,openSUSE-SU-2016:0640