SB2022050403 - Multiple vulnerabilities in Yokogawa CENTUM, ProSafe-RS and B/M9000 VP

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-0203)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing a certain sequence of commands within the svnserve process. A remote non-authenticated attacker can send specially crafted commends to the Subversion server and perform a denial of service (DoS) attack.

2) Reachable Assertion (CVE-ID: CVE-2018-11782)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when handling svnserve 'get-deleted-rev' requests. A remote authenticated attacker with read-only permissions can make the server to reply with incorrect revision number that will lead to svnserve crash.

3) Resource management error (CVE-ID: CVE-2015-0248)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application in the mod_dav_svn and svnserve servers. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://web-material3.yokogawa.com/1/32463/files/YSAR-22-0004-E.pdf?_ga=2.143762992.424376056.1651645224-1390463896.1651645224</p><p><br></p>