sca-2024-0001
Vulnerability from csaf_sick
Published
2024-01-29 00:00
Modified
2024-01-29 00:00
Summary
Vulnerability in SICK Logistics Analytics Products and SICK Field Analytics

Notes

summary
A critical vulnerability in Apache ActiveMQ affects the SICK products Field Analytics 1.2 and Logistics Analytics products 4.5. The Java OpenWire protocol marshaller that is used in ActiveMQ Classic and ActiveMQ Artemis is vulnerable to Remote Code execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Therefore it is strongly recommended to upgrade both Logistics Analytics products 4.5 and Field Analytics 1.2 to the latest release. Prior versions of Logistics Analytics products are not affected.  
General Security Measures
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification
SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.


To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "A critical vulnerability in Apache ActiveMQ affects the SICK products Field Analytics 1.2 and Logistics Analytics products 4.5.\r\n\r\nThe Java OpenWire protocol marshaller that is used in ActiveMQ Classic and ActiveMQ Artemis is vulnerable to Remote Code execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath.\r\n\r\nTherefore it is strongly recommended to upgrade both Logistics Analytics products 4.5 and Field Analytics 1.2 to the latest release.\r\n\r\nPrior versions of Logistics Analytics products are not affected.\r\n\r\n\u00a0",
        "title": "summary"
      },
      {
        "category": "general",
        "text": "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Security Measures"
      },
      {
        "category": "general",
        "text": "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer\u2019s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
        "title": "Vulnerability Classification"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@sick.de",
      "issuing_authority": "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
      "name": "SICK PSIRT",
      "namespace": "https://sick.com/psirt"
    },
    "references": [
      {
        "summary": "SICK PSIRT Security Advisories",
        "url": "https://sick.com/psirt"
      },
      {
        "summary": "SICK Operating Guidelines",
        "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
      },
      {
        "summary": "ICS-CERT recommended practices on Industrial Security",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "summary": "CVSS v3.1 Calculator",
        "url": "https://www.first.org/cvss/calculator/3.1"
      },
      {
        "category": "self",
        "summary": "The canonical URL.",
        "url": "https://www.sick.com/.well-known/csaf/white/2023/"
      }
    ],
    "title": "Vulnerability in SICK Logistics Analytics Products and SICK Field Analytics",
    "tracking": {
      "current_release_date": "2024-01-29T00:00:00.000Z",
      "generator": {
        "date": "2024-01-29T00:00:00.000Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.3.1"
        }
      },
      "id": "sca-2024-0001",
      "initial_release_date": "2024-01-29T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-01-29T00:00:00.000Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "1.2",
                "product": {
                  "name": "SICK Field Analytics 1.2",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Field Analytics"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "4.5",
                    "product": {
                      "name": "SICK Logistics Diagnostic Analytics 4.5",
                      "product_id": "CSAFPID-0002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Logistics Diagnostic Analytics"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "4.5",
                    "product": {
                      "name": "SICK Package Analytics 4.5",
                      "product_id": "CSAFPID-0003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Package Analytics"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "4.5",
                    "product": {
                      "name": "SICK Baggage Analytics 4.5",
                      "product_id": "CSAFPID-0004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Baggage Analytics"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "4.5",
                    "product": {
                      "name": "SICK Tire Analytics 4.5",
                      "product_id": "CSAFPID-0005"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Tire Analytics"
              }
            ],
            "category": "product_family",
            "name": "Logistics Analytics"
          }
        ],
        "category": "vendor",
        "name": "SICK AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-46604",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "audience": "all",
          "category": "summary",
          "text": "The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both Apache ActiveMQ Classic and Apache ActiveMQ Legacy brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Active MQ Notification",
          "url": "https://activemq.apache.org/news/cve-2023-46604"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-01-29T00:00:00.000Z",
          "details": "Customers who use the version 1.2 are strongly recommended to upgrade to the latest release 1.2.2.\n",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2024-01-29T00:00:00.000Z",
          "details": "Customers who use the version 4.5 are strongly recommended to upgrade to the latest release 4.5.1. Prior versions of Logistics Analytics products are not affected.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.