Wibu-Systems CodeMeter Security Advisory: Multiple Vulnerabilities (CVE-2020-14509/14519/14517/16233/14518)

Critical Vulnerability Information 1. Executive Summary CVSS v3: 10.0 Note: Remotely exploitable / Low attack complexity Vendor: Wibu-Systems AG Product: CodeMeter Vulnerabilities: - Buffer Access with Incorrect Length Value CWE-805 - Insufficient Cryptographic Strength CWE-326 - Origin Validation Error CWE-346 - Improper Input Validation CWE-20 - Improper Cryptographic Signature Validation CWE-347 - Improper Resource Release or Disposal CWE-404 2. Update Information This update is a follow-up to the ICS advisory ICSA-20-203-01 Wibu-Systems CodeMeter (Update E), published on the ICS website on February 11, 2021. 3. Risk Assessment Successful exploitation of these vulnerabilities could allow an attacker to modify and forge license files, cause service disruption, achieve remote code execution, read heap data, and prevent third-party software dependent on CodeMeter from functioning properly. 4. Technical Details 4.1 Affected Products All versions prior to 7.10a are affected by CVE-2020-14509 and CVE-2020-14519. All versions prior to 7.10a are affected by CVE-2020-14517. All versions prior to 7.10 are affected by CVE-2020-16233. All versions prior to 6.81 are affected by CVE-2020-14518. All versions prior to 6.90 are affected by CVE-2020-14515 when using CmActLicense update files with CmActLicense company codes. 4.2 Vulnerability Overview 4.2.1 Buffer Access with Incorrect Length Value CWE-805 4.2.2 Insufficient Cryptographic Strength CWE-326 4.2.3 Origin Validation Error CWE-346 4.2.4 Improper Input Validation CWE-20 4.2.5 Improper Cryptographic Signature Validation CWE-347 4.2.6 Improper Resource Release or Disposal CWE-404 5. Mitigation Measures Upgrade to the latest version of CodeMeter Runtime. Run CodeMeter only as a client. Use the new REST API instead of the internal WebSocket API. Disable the WebSocket API. Use AxProtector. Additional Notes Vendors should implement defensive measures in their products to reduce the risk of exploitation.

Goal Reached Thanks to every supporter — we hit 100%!

Wibu-Systems CodeMeter Security Advisory: Multiple Vulnerabilities (CVE-2020-14509/14519/14517/16233/14518)