PT-2017-6492 · Bro · Bro
Travis Emmert
·
Published
2017-04-24
·
Updated
2017-04-27
·
CVE-2015-1521
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Bro versions prior to 2.3.2
Description
The issue arises from improper handling of zero values of a packet length in the DNP3 protocol analyzer, allowing remote attackers to cause a denial of service. This can result in a buffer overflow or buffer over-read if NDEBUG is defined; otherwise, it leads to an assertion failure. The attack is facilitated by a crafted DNP3 packet.
Recommendations
For versions prior to 2.3.2, update to version 2.3.2 or later to resolve the issue.
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bro