PT-2023-4115 · B&R Industrial Automation · B&R Automation Runtime

Published 2023-07-26 · Updated 2024-05-27 · CVE-2023-3242

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions B&R Automation Runtime versions prior to G4.93

Description The issue is related to improper initialization implementation in the Portmapper service used in B&R Industrial Automation Automation Runtime. This allows unauthenticated network-based attackers to cause permanent denial-of-service conditions by exploiting the vulnerability, potentially through sending SYN requests. The vulnerability can also be leveraged to allocate resources without limits or throttling, leading to flooding and leveraging race conditions.

Recommendations For versions prior to G4.93, update to a version G4.93 or later to resolve the issue. As a temporary workaround, consider restricting access to the Portmapper service to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Improper Initialization

Weakness Enumeration

CWE-770

CWE-665

Related Identifiers

BDU:2023-04424

CVE-2023-3242

Affected Products

B&R Automation Runtime

References · 5

• https://bdu.fstec.ru/vul/2023-04424 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-3242 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3242 · Vendor Advisory
• https://br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf · Vendor Advisory
• https://t.me/cibsecurity/67311 · Telegram Post