Multiple vulnerabilities in CODESYS

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU44409

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-5058

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The CmbWebserver.dll module of the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to create arbitrary directories under the web root by specifying a non-existent directory using (backslash) characters in an HTTP GET request.

Mitigation

Install update from vendor's website.

Vulnerable software versions

CODESYS: 3.4

External links

http://aluigi.altervista.org/adv/codesys_1-adv.txt
http://secunia.com/advisories/47018
http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf
http://exchange.xforce.ibmcloud.com/vulnerabilities/72339

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU44425

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2011-5008

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Integer overflow in the GatewayService component in 3S CoDeSys 3.4 SP4 Patch 2. A remote attacker can use a large size value in the packet header to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

CODESYS: 3.4

External links

http://aluigi.altervista.org/adv/codesys_1-adv.txt
http://seclists.org/bugtraq/2011/Nov/178
http://secunia.com/advisories/47018
http://www.osvdb.org/77386
http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf
http://exchange.xforce.ibmcloud.com/vulnerabilities/71531

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU44426

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]

CVE-ID: CVE-2011-5009

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via (1) a crafted Content-Length in an HTTP POST or (2) an invalid HTTP request method.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

CODESYS: 3.4

External links

http://aluigi.altervista.org/adv/codesys_1-adv.txt
http://seclists.org/bugtraq/2011/Nov/178
http://secunia.com/advisories/47018
http://www.osvdb.org/77388
http://www.osvdb.org/77389
http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf
http://exchange.xforce.ibmcloud.com/vulnerabilities/71533

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.