PT-2013-1714 · Rockwell Automation · Rslinx Enterprise

Published 2013-04-18 · Updated 2013-10-02 · CVE-2012-4715

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation RSLinx Enterprise versions CPR9 through CPR9-SR6

Description The issue is related to a buffer overflow in LogReceiver.exe, which can be triggered by remote attackers sending a UDP packet with a certain integer length value that is either too large or too small. This leads to improper handling by Logger.dll, potentially causing a denial of service (daemon crash) or allowing the execution of arbitrary code.

Recommendations For versions CPR9 through CPR9-SR6, consider disabling the LogReceiver.exe service until a patch is available to prevent potential exploitation. Restrict access to the Logger.dll module to minimize the risk of arbitrary code execution. Avoid using UDP packets with integer length values that could trigger the buffer overflow until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-4715

Affected Products

Rslinx Enterprise

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-4715 · Security Note
• https://rockwellautomation.custhelp.com/app/answers/detail/a_id/537599 · Note
• http://ics-cert.us-cert.gov/pdf/ICSA-13-095-02.pdf · Note