Meinberg Security Advisory: [MBGSA-2025.01] LANTIME-Firmware V7.08.020

Description of the Vulnerabilities

• Third-Party-Software:
  • curl:

    • CVE-2024-11053 - netrc and redirect credential leak (low)
      https://curl.se/docs/CVE-2024-11053.html

      Fixed in:
      V7.08.020 MBGID-20666

  • unbound:

    • CVE-2024-8508 - large RRsets can cause denial of service (medium)
      https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt

      Fixed in:
      V7.08.020 MBGID-20777

  • libxml2:

    • CVE-2024-40896 - XXE protection broken in downstream code (high)
      https://nvd.nist.gov/vuln/detail/CVE-2024-40896

      CVE-2024-34459 - buffer over-read in the xmlHTMLPrint-FileContext (low)
      https://nvd.nist.gov/vuln/detail/CVE-2024-34459

      Fixed in:
      V7.08.020 MBGID-20771

      Notice: The library libxml2 is used exclusively to provide IEC61850 functionality.

Systems Affected

All LANTIME firmware versions before 7.08.020 are affected by the corresponding vulnerabilities. The LANTIME firmware is used by all devices of the LANTIME M series (M100, M150, M200, M250, M300, M320, M400, M450, M600, M900) as well as all devices of the LANTIME IMS series (M500, M1000, M1000S, M2000S, M3000, M3000S, M4000) and the SyncFire product family (SF1000, SF1100, SF1200, SF1500) and LANTIME CPU Expansions (LCES).

Whether and to what extent individual clients or LANTIME systems are vulnerable depends on the individual configuration, network infrastructure, and other factors, and it is therefore not possible to provide a general statement on how vulnerable a given system in use actually is.

Possible Security Measures

The relevant security updates are included in the LANTIME firmware versions 7.08.020(-light). Updating to these versions eliminates the listed vulnerabilities.

Download the latest LANTIME firmware at:

• Meinberg LANTIME Firmware

All updates are now available for Meinberg customers. An update of the LANTIME firmware to the version 7.08.020 respectively 7.08.020-light is recommended. Clients who cannot install version 7.08.020 should install version 7.08.020-light instead.

Further Information

Further details and information are available from the following website:

• LANTIME Firmware Changelog: LTOS 7.08

If you have any questions or need assistance, please, do not hesitate to contact Meinberg’s technical support team.

Acknowledgments

We would like to express our gratitude to all those who have advised us of vulnerabilities or other bugs, and have also suggested improvements to us.

Thank you!