RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used.

Security

**Universal encryption key is used in RunAsSpc 4.0**

Specification on Mitre CVE-2022-26660

RunAsSpc 4.0.0.0 use a universal and recoverable encryption key.  
In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used, because encryption key is universal.  
Recovery of the password used for encryption can used for Identity theft and privilege escalation.  

The password must be store reversible to call the application with that encrypted account.  
Reversible credentials are unsafe, because it can be decrypted reverse or intercepted while it is passed to the system.  
See also Microsoft Docs Store passwords >> Data protection

**Solution:**

*   We recommend not using critical credentials with far-reaching privileges in the encrypted file.
*   Modify the password after the job is done.
*   Patched since version 4.1. No longer a universal key.
*   Use the further development RunAsRob without stored credentials.

Vulnarable is notified on 2022-03-01.  
Thanks for the responsible disclosure to the cyber security team INTRINSEC  
intrinsec.com

_Date: 2022-03-07   
Data protection  
Imprint_

CVE-2022-26660: RunAsSpc vulnerable security problem

Hello everyone! I am glad to greet you from the most sanctioned country in the world. Despite all the difficulties, we carry on. I even have some time to release new episodes. This time it will be about Microsoft Patch Tuesday for March 2022. Alternative video link (for Russia): https://vk.com/video-149273431_456239076 I do the analysis as […]

Microsoft Patch Tuesday March 2022

An issue was discovered in Softing OPC UA C++ SDK before 5.70. An invalid XML element in the type dictionary makes the OPC/UA client crash due to an out-of-memory condition.

1.  You are here:
2.  » Industrial
3.  » Solutions
4.  » OPC and OPC UA

**OPC and OPC UA Solutions**

![](https://industrial.softing.com/fileadmin/_processed_/5/e/csm_01_Software_635x198_EN_7160f16fc8.jpg)

With a track record of more than 20 years of experience in OPC technology, Softing is your OPC partner. Softing offers a complete set of OPC Classic and OPC UA (Unified Architecture) products.  Softing's complete OPC portfolio provides a range of solutions from embedding connectivity into your OEM products to helping you solve PLC connectivity up to business enterprise systems.  Check out Softing's world leading OPC book.  Trust Softing with your OPC and OPC UA connnectivity needs.

**Products:**

OPC Products

Product Information

OPC Development Toolkits

OPC UA and OPC Classic Engineering Development Toolkits for OEMs

eATM OPC UA Server

OPC UA Server, in-chassis module for Rockwell ControlLogix PLC

 

 

echoCollect e

OPC UA gateway for over 50 PLC types, echoCollect e is a multi-protocol gateway including protocols such as MQTT and connectivity to SQL databases.  echoCollect e only connects to Ethernet PLCs.

echoCollect r/m

OPC UA gateway for over 50 PLC types, including serial addressable PLCs.  echoCollect r/m is a multi-protocol gateway including protocols such as MQTT and connectivity to SQL databases.  echocollect r/m connects to both Ethernet and Serial PLCs.

dataFEED OPC Suite

dataFEED OPC and OPC UA middleware (software acting as a bridge between databases and applications) and server solutions for connectivity

dataFEED edgeGate

OPC UA and MQTT gateway for Siemens PLCs and Modbus PLCs.  Supports connectivity to Microsoft Azure Connected Factory, Microsoft Azure IoT Hub, IBM Watson, Amazon AWS.

uaGate SI

OPC UA gateway for Siemens PLCs.  Checkout this article on uaGate SI.

uaGate MB

OPC UA gateway for Modbus PLCs

edgegate

OPC UA gateway for Siemens and Modbus PLCs

**OPC Training**

As a world leader in OPC applications, Softing offers education for OPC developers as well as OPC users.

**OPC Use Cases and References**

Read about the echocollect UA in a project implementation in a worldwide network of plants to realize seamless data exchange (PDF)

**OPC Software Trials**

Softing offers free trials with the complete functionality. Runtime is limited to 90 minutes. Under "Downloads" Technology "OPC", you will find the trial version for your desired OPC product.

**OPC Book**

From OPC Data Access to OPC Unified Architecture, the latest edition of the OPC Book provides an excellent overview of the fundamentals, implementation, and application of standardized data exchange via OPC. A key focus is on the new OPC generation – OPC UA – that allows for platform-independent data and information exchange. More information

**OPC Certification**

Independent Test Lab OPC Certification is the process of ensuring that applications meet the standards specified by the OPC Foundation. OPC Certification requires extensive testing to ensure true interoperability. OPC Certification means multi-vendor system interoperability is guaranteed. If your OPC products are not certified, you need to ask your vendor what sort of guarantees they offer.

CVE-2021-42262: OPC and OPC UA | Softing

An issue was discovered in Softing OPC UA C++ SDK before 5.70. A malformed OPC/UA message abort packet makes the client crash with a NULL pointer dereference.

CVE-2021-42577

Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration.

CTX341587

{{tooltipText}}

Security Bulletin | Low | {{likeCount}} found this helpful | Created: {{articleFormattedCreatedDate}} | Modified: {{articleFormattedModifiedDate}}

**Description of Problem**

An issue has been identified in Citrix Federated Authentication Service (FAS) which causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). 

This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration. 

CVE-ID 

Description 

Type 

Pre-requisites 

CVE-2022-26355 

The registration authority certificate's private key is stored in ‘Microsoft Software Key Storage Provider’ even if the Trusted Platform Module was selected 

CWE-668: Exposure of Resource to Wrong Sphere 

Local Administrator access to the FAS server 

Certificates that were generated using the following versions of Citrix Federated Authentication Service are affected by this issue: 

*   Citrix Federated Authentication Service 7.17 - 10.6 

These versions of FAS are included as part of Citrix Virtual Apps and Desktops 2106, and below, and XenApp / XenDesktop 7.17, and above. 

Note that it is the version of FAS that was installed when the certificate was generated which determines if the deployment is affected and not the currently installed version.  

Customers can determine if the registration authority certificate's private key is currently being stored in the TPM by using the following PowerShell commands and reviewing the output: 

Add-PSSnapin Citrix.Authentication.FederatedAuthenticationService.V1
Get-FasAuthorizationCertificate -FullCertInfo -Address localhost

The PrivateKeyProvider field will be set to Microsoft Platform Crypto Provider if the registration authority certificate's private key is stored in the TPM.

**What Customers Should Do**

The issue has been addressed in the following versions of Citrix Federated Authentication Service:

*   Citrix Federated Authentication Service 10.7 and later versions 
*   Citrix Federated Authentication Service 7.24.4000 and later versions of 7.24   
     

These versions of FAS are included as part of the following versions of Citrix Virtual Apps and Desktops: 

*   Citrix Virtual Apps and Desktops 2109 and later versions
*   Citrix Virtual Apps and Desktops 1912 LTSR CU4 and later CU updates  

Citrix recommends that affected customers assess the risk to their environments and, if appropriate, create a new registration authority certificate with the private key stored in the TPM. This can be done by either using the FAS administration console or by updating to a fixed version and then using the PowerShell commands. Installation instructions are available under configuration scenario example 2 at https://docs.citrix.com/en-us/federated-authentication-service/config-manage/private-key-protection.html.   
 

**What Citrix is Doing**

Citrix is notifying customers and channel partners about this potential security issue through the publication of this security bulletin on the Citrix Knowledge Center at https://support.citrix.com/securitybulletins.

**Obtaining Support on This Issue**

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://www.citrix.com/support/open-a-support-case.

**Subscribe to Receive Alerts**

Citrix strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified at https://support.citrix.com/user/alerts.

**Reporting Security Vulnerabilities to Citrix**

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please see the following webpage: https://www.citrix.com/about/trust-center/vulnerability-process.html.

**Disclaimer**

This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. Citrix reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document directly from the Citrix Knowledge Center.

**Changelog**

Date

Change

2022-03-08

Initial Publication

CVE-2022-26355: Citrix Federated Authentication Service (FAS) Security Update

Microsoft Office Visio Remote Code Execution Vulnerability

CVE-2022-24509

Microsoft Office Word Tampering Vulnerability

CVE-2022-24511

CVE-2022-24510

Microsoft Exchange Server Remote Code Execution Vulnerability.

CVE-2022-23277

Microsoft Office Word Tampering Vulnerability.

Tag

#microsoft