Heap-based buffer overflow in Delta Industrial Automation DOPSoft - CVE-2018-10617
Published: June 1, 2018
Vulnerability identifier: #VU13120
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-10617
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The vulnerability exists due to the application utilizes a fixed-length heap buffer where a value larger than the buffer can be read from a .dpa file into the buffer. A remote unauthenticated attacker can trigger heap-based buffer overflow and cause the service to crash or execute arbitrary code with elevated privileges.
Affected software
Delta Industrial Automation DOPSoft
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse
How to mitigate CVE-2018-10617
Install update from vendor's website.