Software Engineering Institute

Statement Date:   June 26, 2020

Vendor Statement

Please reference the Fujitsu PSIRT (CEE, NWE, UK&I) Security Advisory link provided in the references section.

References

• https://support.ts.fujitsu.com/content/Fujitsu-PSIRT-PMD-IS-2019-121916.asp
• https://jvn.jp/vu/JVNVU94736763/index.html

CERT Addendum

Please visit JPCERT status page for Fujitsu's status https://jvn.jp/vu/JVNVU94736763/index.html

Statement Date:   July 10, 2020

Vendor Statement

Green Hills Software LLC’s GHnet™ v2 network stack is based on the network stack from Treck Inc. Treck informed Green Hills Software of multiple vulnerabilities in its network stack, which were found by a third party.

While GHnet v2 is based on Treck’s network stack, the two are not identical. Green Hills Software has made many improvements, added new features, and fixed bugs in the product. Because of these improvements and INTEGRITY’s separation kernel architecture, the impact of these vulnerabilities on GHnet v2 is far less severe.

Green Hills Software has and will continue to advocate for running middleware, driver, and application code in partitioned virtual address spaces, rather than in the kernel. The INTEGRITY Real-Time Operating System was designed to provide isolation between applications and the kernel, protecting the rest of the system if an application fails or misbehaves. Due to the isolation provided by INTEGRITY, running the GHnet v2 stack in a virtual address space significantly reduces the impact of these vulnerabilities. Green Hills Software strongly recommends that the GHnet v2 network stack, all other middleware, and all application code be placed in separate virtual address spaces.

Green Hills Software will include fixes for these vulnerabilities in future releases of GHnet v2, and is making patches available to customers on previous releases. If you have questions about how these vulnerabilities may affect your system, please contact your Green Hills Software sales representative, or contact Green Hills Software Technical Support.

References

• https://support.ghs.com/psirt/PSA-2020-05/

Vendor Statement

Please see HPE official link for information about ripple20 from HPE in the references section. For HPE's Aruba specific devices please see Aruba advisory PSA-2020-006.

References

• https://www.hpe.com/us/en/services/security-vulnerability.html
• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt
• https://techhub.hpe.com/eginfolib/securityalerts/Ripple20/Ripple20.html

Vendor Statement

We have not received a statement from the vendor.

References

• https://support.hp.com/us-en/document/c06640149
• https://support.hp.com/us-en/document/c06655639

CERT Addendum

HP Security Bulletin ID c06655639 addresses Treck's vulnerability inherited through Intel. HP Security Bulletin c06640149 addresses HP and Samsung branded products that are impacted from Treck's embedded IP stack.

Vendor Statement

Please visit Intel's public security advisory SA-00295 for information.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html

CERT Addendum

Please check Intel's advisory that provides mapping relevant mapping to Treck's CVE listed in this advisory.

Statement Date:   September 25, 2020

Vendor Statement

We have published an advisory on our official website. We are continuing to investigate impacts of this vulnerability for our products. We will update the advisory as needed.

References

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-010_en.pdf

Statement Date:   July 31, 2020

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.ricoh-usa.com/en/support-and-download/alerts/alerts-security-vulnerability-announcements

CERT Addendum

Ricoh has provided a public statement on Treck IP Stacks vulnerabilities, please use the link provided above.

Vendor Statement

See Rockwell's advisory https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896

Vendor Statement

Schneider has provided a security advisory SESB-2020-168-01 addressing this issue.

References

• https://www.se.com/ww/en/download/document/SESB-2020-168-01
• https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp

Vendor Statement

Teradici has issued a security advisory (TERA-SA-000056) and has addressed this issue with updated firmware for Tera2 PCoIP Zero Clients and PCoIP Remote Workstation cards.

References

• https://advisory.teradici.com/security-advisories/56/

Statement Date:   August 19, 2020

Vendor Statement

We are continuing to investigate impacts of this vulnerability for some products. We will contact the related customers.

Vendor Statement

Treck's customers can contact us for additional details than what is in the advisory.

References

• https://treck.com/vulnerability-response-information/

Vendor Statement

We have not received a statement from the vendor.

References

• https://security.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20J_for_B2XX.pdf

CERT Addendum

Please see Xerox advisory mini bulletin XRX20J dated June 16,2020

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.elwsc.co.jp/news/4136/
• https://www.elwsc.co.jp/wp-content/uploads/2020/06/KASAGO202006-1.pdf

CERT Addendum

Please see ELMIC's statement provided in References. Note that this product is also known as KASAGO TCP/IP.