PT-2013-1714 · Rockwell Automation · Rslinx Enterprise

Publicado 2013-04-18 · Atualizado 2013-10-02 · CVE-2012-4715

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation RSLinx Enterprise versions CPR9 through CPR9-SR6

Description The issue is related to a buffer overflow in LogReceiver.exe, which can be triggered by remote attackers sending a UDP packet with a certain integer length value that is either too large or too small. This leads to improper handling by Logger.dll, potentially causing a denial of service (daemon crash) or allowing the execution of arbitrary code.

Recommendations For versions CPR9 through CPR9-SR6, consider disabling the LogReceiver.exe service until a patch is available to prevent potential exploitation. Restrict access to the Logger.dll module to minimize the risk of arbitrary code execution. Avoid using UDP packets with integer length values that could trigger the buffer overflow until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-4715

Produtos afetados

Rslinx Enterprise

Referências · 3

• https://rockwellautomation.custhelp.com/app/answers/detail/a_id/537599 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4715 · Nota de Segurança
• http://ics-cert.us-cert.gov/pdf/ICSA-13-095-02.pdf · Nota