Details of VAR-201112-0099

ID

VAR-201112-0099

CVE

CVE-2011-5009

TITLE

3S CoDeSys CmpWebServer.dll Module Denial of Service Vulnerability

Trust: 1.6

sources: IVD: 45cf0374-2354-11e6-abef-000c29c66e3d // IVD: 7d7e646e-463f-11e9-8e21-000c29342cb1 // CNVD: CNVD-2011-5589 // CNNVD: CNNVD-201112-449

DESCRIPTION

The CmpWebServer.dll module in the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a crafted Content-Length in an HTTP POST or (2) an invalid HTTP request method. CoDeSys Automation Suite is a comprehensive software tool for industrial automation technology. CoDeSys has multiple remote denial of service vulnerabilities in its implementation, which can be exploited by remote attackers to crash applications and deny legitimate users. A vulnerability exists in the CmpWebServer.dll module in the Control service in the 3S CoDeSys 3.4 SP4 Patch 2 release. CoDeSys is prone to multiple denial-of-service vulnerabilities. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: CoDeSys Multiple Vulnerabilities SECUNIA ADVISORY ID: SA47018 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47018/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47018 RELEASE DATE: 2011-12-01 DISCUSS ADVISORY: http://secunia.com/advisories/47018/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47018/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47018 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Luigi Auriemma has discovered multiple vulnerabilities in CoDeSys, which can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system. 1) An integer overflow error in the Gateway service when processing certain requests can be exploited to cause a heap-based buffer overflow via a specially crafted packet sent to TCP port 1217. 2) A boundary error in the Control service when processing web requests can be exploited to cause a stack-based buffer overflow via an overly long URL sent to TCP port 8080. 5) An error in the Control service when processing web requests containing a non-existent directory can be exploited to create arbitrary directories within the webroot via requests sent to TCP port 8080. Successful exploitation of vulnerabilities #1 and #2 allows execution of arbitrary code. The vulnerabilities are confirmed in version 3.4 SP4 Patch 2. Other versions may also be affected. SOLUTION: Restrict access to trusted hosts only. PROVIDED AND/OR DISCOVERED BY: Luigi Auriemma ORIGINAL ADVISORY: http://aluigi.altervista.org/adv/codesys_1-adv.txt OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.6

sources: NVD: CVE-2011-5009 // JVNDB: JVNDB-2011-003532 // CNVD: CNVD-2011-5258 // CNVD: CNVD-2011-5589 // BID: 50854 // IVD: 45cf0374-2354-11e6-abef-000c29c66e3d // IVD: 2416614a-1f7c-11e6-abef-000c29c66e3d // IVD: 7d7e646e-463f-11e9-8e21-000c29342cb1 // PACKETSTORM: 107457

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.8

AFFECTED PRODUCTS

vendor:	3ssoftware	model:	codesys	scope:	eq	version:	3.4	Trust: 1.6
vendor:	3s smart	model:	codesys sp4 patch	scope:	eq	version:	3.42	Trust: 0.9
vendor:	3s smart	model:	codesys	scope:	eq	version:	3.4 sp4 patch 2	Trust: 0.8
vendor:	codesys	model:	-	scope:	eq	version:	3.4	Trust: 0.6
vendor:	3ssoftware	model:	codesys3.4 sp4	scope:	-	version:	-	Trust: 0.6
vendor:	3s smart	model:	codesys	scope:	eq	version:	3.4	Trust: 0.3
vendor:	3s smart	model:	codesys	scope:	eq	version:	2.3	Trust: 0.3
vendor:	3s smart	model:	codesys	scope:	ne	version:	3.5	Trust: 0.3
vendor:	3s smart	model:	codesys	scope:	ne	version:	2.3.9.32	Trust: 0.3

sources: IVD: 45cf0374-2354-11e6-abef-000c29c66e3d // IVD: 2416614a-1f7c-11e6-abef-000c29c66e3d // IVD: 7d7e646e-463f-11e9-8e21-000c29342cb1 // CNVD: CNVD-2011-5258 // CNVD: CNVD-2011-5589 // BID: 50854 // JVNDB: JVNDB-2011-003532 // CNNVD: CNNVD-201112-449 // NVD: CVE-2011-5009

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2011-5009
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2011-5009
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2011-5589
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201112-449
value:	MEDIUM
Trust: 0.6
IVD:	45cf0374-2354-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2
IVD:	2416614a-1f7c-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2
IVD:	7d7e646e-463f-11e9-8e21-000c29342cb1
value:	MEDIUM
Trust: 0.2

nvd@nist.gov:	CVE-2011-5009
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2011-5589
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	45cf0374-2354-11e6-abef-000c29c66e3d
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	2416614a-1f7c-11e6-abef-000c29c66e3d
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	7d7e646e-463f-11e9-8e21-000c29342cb1
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

sources: IVD: 45cf0374-2354-11e6-abef-000c29c66e3d // IVD: 2416614a-1f7c-11e6-abef-000c29c66e3d // IVD: 7d7e646e-463f-11e9-8e21-000c29342cb1 // CNVD: CNVD-2011-5589 // JVNDB: JVNDB-2011-003532 // CNNVD: CNNVD-201112-449 // NVD: CVE-2011-5009

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2011-003532 // NVD: CVE-2011-5009

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201111-514 // CNNVD: CNNVD-201112-449

TYPE

other

Trust: 1.2

sources: IVD: 45cf0374-2354-11e6-abef-000c29c66e3d // IVD: 2416614a-1f7c-11e6-abef-000c29c66e3d // IVD: 7d7e646e-463f-11e9-8e21-000c29342cb1 // CNNVD: CNNVD-201112-449

CONFIGURATIONS

sources: JVNDB: JVNDB-2011-003532

PATCH

title:	Top Page	url:	http://www.3s-software.com/	Trust: 0.8
title:	3S CoDeSys CmpWebServer.dll module denial of service vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/37426	Trust: 0.6

sources: CNVD: CNVD-2011-5589 // JVNDB: JVNDB-2011-003532

EXTERNAL IDS

db:	NVD	id:	CVE-2011-5009	Trust: 3.9
db:	ICS CERT ALERT	id:	ICS-ALERT-11-336-01A	Trust: 2.4
db:	SECUNIA	id:	47018	Trust: 2.3
db:	OSVDB	id:	77388	Trust: 1.6
db:	OSVDB	id:	77389	Trust: 1.6
db:	BID	id:	50854	Trust: 1.5
db:	CNNVD	id:	CNNVD-201112-449	Trust: 1.2
db:	CNVD	id:	CNVD-2011-5589	Trust: 1.0
db:	CNVD	id:	CNVD-2011-5258	Trust: 0.8
db:	JVNDB	id:	JVNDB-2011-003532	Trust: 0.8
db:	CNNVD	id:	CNNVD-201111-514	Trust: 0.6
db:	BUGTRAQ	id:	20111129 VULNERABILITIES IN 3S CODESYS 3.4 SP4 PATCH 2	Trust: 0.6
db:	ICS CERT	id:	ICSA-12-006-01	Trust: 0.3
db:	IVD	id:	45CF0374-2354-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	IVD	id:	2416614A-1F7C-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	IVD	id:	7D7E646E-463F-11E9-8E21-000C29342CB1	Trust: 0.2
db:	PACKETSTORM	id:	107457	Trust: 0.1

sources: IVD: 45cf0374-2354-11e6-abef-000c29c66e3d // IVD: 2416614a-1f7c-11e6-abef-000c29c66e3d // IVD: 7d7e646e-463f-11e9-8e21-000c29342cb1 // CNVD: CNVD-2011-5258 // CNVD: CNVD-2011-5589 // BID: 50854 // JVNDB: JVNDB-2011-003532 // PACKETSTORM: 107457 // CNNVD: CNNVD-201111-514 // CNNVD: CNNVD-201112-449 // NVD: CVE-2011-5009

REFERENCES

url:	http://aluigi.altervista.org/adv/codesys_1-adv.txt	Trust: 2.6
url:	http://www.us-cert.gov/control_systems/pdf/ics-alert-11-336-01a.pdf	Trust: 2.4
url:	http://secunia.com/advisories/47018	Trust: 2.2
url:	http://www.osvdb.org/77389	Trust: 1.6
url:	http://www.osvdb.org/77388	Trust: 1.6
url:	http://seclists.org/bugtraq/2011/nov/178	Trust: 1.6
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/71533	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-5009	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-5009	Trust: 0.8
url:	http://www.securityfocus.com/bid/50854	Trust: 0.6
url:	http://www.3s-software.com/index.shtml?en_codesysv3_en	Trust: 0.3
url:	http://www.us-cert.gov/control_systems/pdf/icsa-12-006-01.pdf	Trust: 0.3
url:	http://secunia.com/company/jobs/	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=47018	Trust: 0.1
url:	http://secunia.com/advisories/47018/#comments	Trust: 0.1
url:	http://secunia.com/advisories/47018/	Trust: 0.1

sources: CNVD: CNVD-2011-5258 // CNVD: CNVD-2011-5589 // BID: 50854 // JVNDB: JVNDB-2011-003532 // PACKETSTORM: 107457 // CNNVD: CNNVD-201111-514 // CNNVD: CNNVD-201112-449 // NVD: CVE-2011-5009

CREDITS

Luigi Auriemma

Trust: 0.9

sources: BID: 50854 // CNNVD: CNNVD-201111-514

SOURCES

db:	IVD	id:	45cf0374-2354-11e6-abef-000c29c66e3d
db:	IVD	id:	2416614a-1f7c-11e6-abef-000c29c66e3d
db:	IVD	id:	7d7e646e-463f-11e9-8e21-000c29342cb1
db:	CNVD	id:	CNVD-2011-5258
db:	CNVD	id:	CNVD-2011-5589
db:	BID	id:	50854
db:	JVNDB	id:	JVNDB-2011-003532
db:	PACKETSTORM	id:	107457
db:	CNNVD	id:	CNNVD-201111-514
db:	CNNVD	id:	CNNVD-201112-449
db:	NVD	id:	CVE-2011-5009

LAST UPDATE DATE

2024-08-14T14:21:34.368000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2011-5258	date:	2011-12-14T00:00:00
db:	CNVD	id:	CNVD-2011-5589	date:	2011-12-26T00:00:00
db:	BID	id:	50854	date:	2012-01-10T20:00:00
db:	JVNDB	id:	JVNDB-2011-003532	date:	2011-12-28T00:00:00
db:	CNNVD	id:	CNNVD-201111-514	date:	2011-12-02T00:00:00
db:	CNNVD	id:	CNNVD-201112-449	date:	2012-01-06T00:00:00
db:	NVD	id:	CVE-2011-5009	date:	2017-08-29T01:30:38.647

SOURCES RELEASE DATE

db:	IVD	id:	45cf0374-2354-11e6-abef-000c29c66e3d	date:	2011-12-26T00:00:00
db:	IVD	id:	2416614a-1f7c-11e6-abef-000c29c66e3d	date:	2011-12-14T00:00:00
db:	IVD	id:	7d7e646e-463f-11e9-8e21-000c29342cb1	date:	2011-12-26T00:00:00
db:	CNVD	id:	CNVD-2011-5258	date:	2011-12-14T00:00:00
db:	CNVD	id:	CNVD-2011-5589	date:	2011-12-26T00:00:00
db:	BID	id:	50854	date:	2011-11-30T00:00:00
db:	JVNDB	id:	JVNDB-2011-003532	date:	2011-12-28T00:00:00
db:	PACKETSTORM	id:	107457	date:	2011-12-01T04:30:55
db:	CNNVD	id:	CNNVD-201111-514	date:	1900-01-01T00:00:00
db:	CNNVD	id:	CNNVD-201112-449	date:	2011-12-26T00:00:00
db:	NVD	id:	CVE-2011-5009	date:	2011-12-25T01:55:04.727