#VU49156 Uncaught Exception in FactoryTalk Linx - CVE-2020-5801

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an uncaught exception when processing OpenNamespace messages. The OpenNamespace message is sent to TCP port 4241 to obtain a session identifier. Subsequent requests require a valid session-id to interact with the service listening on that port. In the OpenNamespace message, the session-id field in the message header should be absent or empty. If a second OpenNamespace request is sent with a valid session-id in it, the CFTLDManager::HandleRequest function in RnaDaSvr.dll loaded in RSLinxNG.exe leads to unhandled exception, resulting in termination of RSLinxNG.exe.

A remote non-authenticated attacker can send a malformed request and crash the RSLinxNG.exe service.

Remediation

External links

• https://www.tenable.com/security/research/tra-2020-71
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129496/redirect
• https://ics-cert.us-cert.gov/advisories/icsa-21-028-01