Siemens Automation License Manager up to 5.x/6.2 Upd2 TCP Port 4410 integer overflow

Summaryinfo

A vulnerability classified as critical was found in Siemens Automation License Manager up to 5.x/6.2 Upd2. Affected by this issue is some unknown functionality of the component TCP Port 4410. The manipulation results in integer overflow. This vulnerability was named CVE-2024-44087. The attack may be performed from remote. There is no available exploit. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical has been found in Siemens Automation License Manager up to 5.x/6.2 Upd2. Affected is an unknown function of the component TCP Port 4410. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on availability. CVE summarizes:

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification.

The advisory is shared for download at cert-portal.siemens.com. This vulnerability is traded as CVE-2024-44087 since 08/19/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/11/2024).

Applying the patch 6.2 Upd3 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• Siemens

Name

• Automation License Manager

Version

• 5.x
• 6.2 Upd2

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion