PT-2023-24020 · Unknown · Opc Ua Legacy Java Stack

Jouniaro · Published 2023-05-15 · Updated 2024-04-02 · CVE-2023-32787

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OPC UA Legacy Java Stack versions prior to 6f176f2

Description The issue allows an attacker to block OPC UA server applications via uncontrolled resource consumption, causing them to be unable to serve client applications. This is a denial-of-service vulnerability that can be exploited to exhaust resources.

Recommendations For versions prior to 6f176f2, update to a version that includes the fix for this issue to prevent resource exhaustion attacks. As a temporary workaround, consider implementing measures to limit resource consumption by the OPC UA server application.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-32787

ZDI-23-709

ZDI-23-778

Affected Products

Opc Ua Legacy Java Stack

References · 8

• https://github.com/OPCFoundation/UA-Java-Legacy/commit/6f176f2b445a27c157f1a32f225accc9ce8873c0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-32787 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32787 · Vendor Advisory
• https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-32787.pdf · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-709 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-778 · Security Note
• https://github.com/OPCFoundation/UA-Java-Legacy · Note
• https://t.me/cibsecurity/64144 · Telegram Post