PT-2013-3937 · Triangle Microworks · Scada Data Gateway+2

Adam Crain + 1 · Published 2013-09-09 · Updated 2013-10-08 · CVE-2013-2794

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Triangle MicroWorks SCADA Data Gateway versions 2.50.0309 through 3.00.0616 DNP3 .NET Protocol components versions 3.06.0.171 through 3.15.0.369 DNP3 C libraries versions 3.06.0000 through 3.15.0000

Description The issue allows physically proximate attackers to cause a denial of service, resulting in an infinite loop, via crafted input over a serial line.

Recommendations For Triangle MicroWorks SCADA Data Gateway versions 2.50.0309 through 3.00.0616, update to a version outside of this range to resolve the issue. For DNP3 .NET Protocol components versions 3.06.0.171 through 3.15.0.369, update to a version outside of this range to resolve the issue. For DNP3 C libraries versions 3.06.0000 through 3.15.0000, update to a version outside of this range to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-2794

Affected Products

Dnp3 .Net Protocol Components

Dnp3 C Libraries

Scada Data Gateway

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-2794 · Security Note
• http://ics-cert.us-cert.gov/advisories/ICSA-13-240-01 · Note
• http://trianglemicroworks.com/documents/mdnp_scl_whats_new.pdf · Note