PT-2023-24020 · Unknown · Opc Ua Legacy Java Stack

Jouniaro · Publicado 2023-05-15 · Atualizado 2024-04-02 · CVE-2023-32787

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OPC UA Legacy Java Stack versions prior to 6f176f2

Description The issue allows an attacker to block OPC UA server applications via uncontrolled resource consumption, causing them to be unable to serve client applications. This is a denial-of-service vulnerability that can be exploited to exhaust resources.

Recommendations For versions prior to 6f176f2, update to a version that includes the fix for this issue to prevent resource exhaustion attacks. As a temporary workaround, consider implementing measures to limit resource consumption by the OPC UA server application.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-32787

ZDI-23-709

ZDI-23-778

Produtos afetados

Opc Ua Legacy Java Stack

Referências · 8

• https://github.com/OPCFoundation/UA-Java-Legacy · Nota
• https://github.com/OPCFoundation/UA-Java-Legacy/commit/6f176f2b445a27c157f1a32f225accc9ce8873c0 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-32787 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32787 · Aviso do Fabricante
• https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-32787.pdf · Aviso do Fabricante
• https://t.me/cibsecurity/64144 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-709 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-23-778 · Nota de Segurança