News from 2024-02-27
Meinberg Security Advisory: [MBGSA-2024.02] LANTIME-Firmware V7.08.009
Meinberg recommends updating to LANTIME firmware version 7.08.009.
-
LANTIME-Firmware V7.08.007:
severity level critical(0), high (1), medium (2), low (2), info (0), unknown (0)
- LANTIME firmware: V7.08.009
-
Description of the Vulnerabilities
- Third-Party-Software:
- OpenSSL:
-
CVE-2024-0727 - PKCS12 Decoding crashes (low)
https://www.openssl.org/news/secadv/20240125.txt
Fixed in:
V7.08.008 MBGID-16793
-
CVE-2024-0727 - PKCS12 Decoding crashes (low)
- curl:
-
CVE-2024-0853 - OCSP verification bypass with TLS session reuse (low)
https://curl.se/docs/CVE-2024-0853.html
Fixed in:
V7.08.008 MBGID-16810
-
CVE-2024-0853 - OCSP verification bypass with TLS session reuse (low)
- zlib:
-
CVE-2023-45853 - minizip: Check length of comment, filename, and extra field, in zipOpenNewFileInZip4_64 (high)
https://github.com/madler/zlib/pull/843
Fixed in:
V7.08.008 MBGID-16684
-
CVE-2023-45853 - minizip: Check length of comment, filename, and extra field, in zipOpenNewFileInZip4_64 (high)
- gnutls:
-
CVE-2024-0553 - timing side-channel inside RSA-PSK key exchange (medium)
https://www.gnutls.org/security-new.html#GNUTLS-SA-2024-01-14
CVE-2024-0567 - assertion failure when verifying a certificate chain with a cycle of cross signatures (medium)https://www.gnutls.org/security-new.html#GNUTLS-SA-2024-01-09
Fixed in:
V7.08.008 MBGID-16670
-
CVE-2024-0553 - timing side-channel inside RSA-PSK key exchange (medium)
- OpenSSL:
- Third-Party-Software:
-
Systems Affected
All LANTIME firmware versions before 7.08.009 are affected by the corresponding vulnerabilities. The LANTIME firmware is used by all devices of the LANTIME M series (M100, M150, M200, M250, M300, M320, M400, M450, M600, M900) as well as all devices of the LANTIME IMS series (M500, M1000, M1000S, M2000S, M3000, M3000S, M4000), the SyncFire product family (SF1000, SF1100, SF1200, SF1500) and LANTIME CPU Expansions (LCES).
Whether and to what extent individual clients or LANTIME systems are vulnerable depends on the individual configuration, network infrastructure, and other factors, and it is therefore not possible to provide a general statement on how vulnerable a given system in use actually is.
-
Possible Security Measures
The relevant security updates are included in the LANTIME firmware versions 7.08.009(-light). Updating to these versions eliminates the listed vulnerabilities.
Download the latest LANTIME firmware at:
All updates are now available for Meinberg customers. An update of the LANTIME firmware to the version 7.08.009 respectively 7.08.009-light is recommended. Clients who cannot install version 7.08.009 should install version 7.08.009-light instead.
-
Further Information
If you have any questions or need assistance, please, do not hesitate to contact Meinberg’s technical support team.
-
Acknowledgments
We would like to express our gratitude to all those who have advised us of vulnerabilities or other bugs, and have also suggested improvements to us.
Thank you!