Siemens OpenSSL in Industrial Products (CVE-2021-3449)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500504);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/12/12");

  script_cve_id("CVE-2021-3449");
  script_xref(name:"DSA", value:"DSA-4875");
  script_xref(name:"GLSA", value:"GLSA-202103-03");
  script_xref(name:"FEDORA", value:"FEDORA-2021-cbf14ab8f9");
  script_xref(name:"CEA-ID", value:"CEA-2021-0025");

  script_name(english:"Siemens OpenSSL in Industrial Products (CVE-2021-3449)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An OpenSSL TLS server may crash if sent a maliciously crafted
renegotiation ClientHello message from a client. If a TLSv1.2
renegotiation ClientHello omits the signature_algorithms extension
(where it was present in the initial ClientHello), but includes a
signature_algorithms_cert extension then a NULL pointer dereference
will result, leading to a crash and a denial of service attack. A
server is only vulnerable if it has TLSv1.2 and renegotiation enabled
(which is the default configuration). OpenSSL TLS clients are not
impacted by this issue. All OpenSSL 1.1.1 versions are affected by
this issue. Users of these versions should upgrade to OpenSSL 1.1.1k.
OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k
(Affected 1.1.1-1.1.1j).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fb9fa6b51defd48157eeb207f52181f735d96148
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6aafb4b2");
  script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/news/secadv/20210325.txt");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a21cd9d");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2021/dsa-4875");
  script_set_attribute(attribute:"see_also", value:"https://security.netapp.com/advisory/ntap-20210326-0006/");
  script_set_attribute(attribute:"see_also", value:"https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc");
  script_set_attribute(attribute:"see_also", value:"http://www.openwall.com/lists/oss-security/2021/03/27/1");
  script_set_attribute(attribute:"see_also", value:"http://www.openwall.com/lists/oss-security/2021/03/27/2");
  script_set_attribute(attribute:"see_also", value:"http://www.openwall.com/lists/oss-security/2021/03/28/3");
  script_set_attribute(attribute:"see_also", value:"http://www.openwall.com/lists/oss-security/2021/03/28/4");
  script_set_attribute(attribute:"see_also", value:"https://security.gentoo.org/glsa/202103-03");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/tns-2021-06");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/tns-2021-05");
  # https://lists.fedoraproject.org/archives/list/[email protected]/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9e6d325e");
  script_set_attribute(attribute:"see_also", value:"https://kc.mcafee.com/corporate/index?page=content&id=SB10356");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/tns-2021-09");
  script_set_attribute(attribute:"see_also", value:"https://security.netapp.com/advisory/ntap-20210513-0002/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-05");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/tns-2021-10");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuApr2021.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf");
  script_set_attribute(attribute:"see_also", value:"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845");
  script_set_attribute(attribute:"see_also", value:"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com//security-alerts/cpujul2021.html");
  script_set_attribute(attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuoct2021.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuapr2022.html");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpujul2022.html");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has released updates for several affected products and recommends updating to the latest versions available.
Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet
available. Please see Siemens SSA-772220 to determine if there is an update available.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the
environment according to Siemens' operational guidelines for industrial security, and to follow the recommendations in
the product manuals. Additional information on Industrial Security by Siemens can be found at:
https://www.siemens.com/industrialsecurity

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens.

Additional Reference: SSA-772220 (PDF)

Additional Reference: SSA-772220 (TXT)

Additional Reference: SSA-772220 (CSAF)");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-3449");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/03/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/03/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rcm1224_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_lpe9403_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_m-800_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_s602_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_s612_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_s615_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_s623_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_s627-2m_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_sc-600_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_w1700_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_w700_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xb-200_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-200_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xf-200ba_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xm-400_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xp-200_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-300wg_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr524-8c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr526-8c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr528-6m_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr552-12_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_cp_1242-7_gprs_v2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_cp_1242-7_gprs_v2_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp1243-7_lte_eu_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp1243-7_lte_us_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp_1243-1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp_1243-8_irc_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp_1542sp-1_irc_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp_1543-1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp_1543sp-1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_net_cp_1545-1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1211c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1212c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1212fc_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1214_fc_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1214c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1215_fc_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1215c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_1217c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_1518-4_pn%2fdp_mfp_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rcm1224_firmware" :
        {"versionStartIncluding" : "6.2", "family" : "RuggedCom"},
    "cpe:/o:siemens:scalance_lpe9403_firmware" :
        {"family" : "SCALANCE"},
    "cpe:/o:siemens:scalance_m-800_firmware" :
        {"versionStartIncluding" : "6.2", "family" : "SCALANCEM"},
    "cpe:/o:siemens:scalance_s602_firmware" :
        {"versionStartIncluding" : "4.1", "family" : "SCALANCES"},
    "cpe:/o:siemens:scalance_s612_firmware" :
        {"versionStartIncluding" : "4.1", "family" : "SCALANCES"},
    "cpe:/o:siemens:scalance_s615_firmware" :
        {"versionStartIncluding" : "6.2", "family" : "SCALANCES"},
    "cpe:/o:siemens:scalance_s623_firmware" :
        {"versionStartIncluding" : "4.1", "family" : "SCALANCES"},
    "cpe:/o:siemens:scalance_s627-2m_firmware" :
        {"versionStartIncluding" : "4.1", "family" : "SCALANCES"},
    "cpe:/o:siemens:scalance_sc-600_firmware" :
        {"versionStartIncluding" : "2.0", "family" : "SCALANCES"},
    "cpe:/o:siemens:scalance_w700_firmware" :
        {"versionStartIncluding" : "6.5", "family" : "SCALANCEW"},
    "cpe:/o:siemens:scalance_w1700_firmware" :
        {"versionStartIncluding" : "2.0", "family" : "SCALANCEW"},
    "cpe:/o:siemens:scalance_xb-200_firmware" :
        {"versionEndExcluding" : "4.3", "family" : "SCALANCEX200"},
    "cpe:/o:siemens:scalance_xc-200_firmware" :
        {"versionEndExcluding" : "4.3", "family" : "SCALANCEX200"},
    "cpe:/o:siemens:scalance_xf-200ba_firmware" :
        {"versionEndExcluding" : "4.3", "family" : "SCALANCEX200"},
    "cpe:/o:siemens:scalance_xm-400_firmware" :
        {"versionEndExcluding" : "6.4", "family" : "SCALANCEX400"},
    "cpe:/o:siemens:scalance_xp-200_firmware" :
        {"versionEndExcluding" : "4.3", "family" : "SCALANCEX200"},
    "cpe:/o:siemens:scalance_xr-300wg_firmware" :
        {"versionEndExcluding" : "4.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr524-8c_firmware" :
        {"versionEndExcluding" : "6.4", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xr526-8c_firmware" :
        {"versionEndExcluding" : "6.4", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xr528-6m_firmware" :
        {"versionEndExcluding" : "6.4", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xr552-12_firmware" :
        {"versionEndExcluding" : "6.4", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:simatic_cp_1242-7_gprs_v2_firmware:-" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_cp_1242-7_gprs_v2_firmware" :
        {"versionStartIncluding" : "3.1", "family" : "S71200"},
    "cpe:/o:siemens:simatic_net_cp_1243-1_firmware" :
        {"versionStartIncluding" : "3.1", "family" : "S71200"},
    "cpe:/o:siemens:simatic_net_cp1243-7_lte_eu_firmware" :
        {"versionStartIncluding" : "3.1", "family" : "S71200"},
    "cpe:/o:siemens:simatic_net_cp1243-7_lte_us_firmware" :
        {"versionStartIncluding" : "3.1", "family" : "S71200"},
    "cpe:/o:siemens:simatic_net_cp_1243-8_irc_firmware" :
        {"versionStartIncluding" : "3.1", "family" : "S71200"},
    "cpe:/o:siemens:simatic_net_cp_1542sp-1_irc_firmware" :
        {"versionStartIncluding" : "2.1", "family" : "S71500"},
    "cpe:/o:siemens:simatic_net_cp_1543-1_firmware" :
        {"versionEndExcluding" : "3.0", "versionStartIncluding" : "2.2", "family" : "S71500"},
    "cpe:/o:siemens:simatic_net_cp_1543sp-1_firmware" :
        {"versionStartIncluding" : "2.1", "family" : "S71500"},
    "cpe:/o:siemens:simatic_net_cp_1545-1_firmware" :
        {"versionStartIncluding" : "1.0", "family" : "S71500"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1211c_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1212c_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1212fc_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1214_fc_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1214c_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1215_fc_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1215c_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1200_cpu_1217c_firmware" :
        {"family" : "S71200"},
    "cpe:/o:siemens:simatic_s7-1500_cpu_1518-4_pn%2fdp_mfp_firmware" :
        {"family" : "S71500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);