Multiple security vulnerabilities in CoDeSys 'Gateway Server'

Release date:
Updated on:

Affected Systems:
3 S CoDeSys 2.x
3 S CoDeSys Gateway Server 2.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 58032
CVE (CAN) ID: CVE-2012-4704, CVE-2012-4705, CVE-2012-4706, CVE-2012-4707, CVE-2012-4708
 
CoDeSys is a hardware-independent IEC 61131-3 Development System on Windows. It is used to program and create Controller Applications.
 
CoDeSys 2.3.9.27 and other versions have multiple vulnerabilities, such as stack overflow, when processing certain packets.
 
Cve-2012-4704
The boundary restriction is lax ("range error"), and the 3 S CoDeSys Gateway Server limits its operations in a specific memory buffer, cve-2012-4704 vulnerabilities allow attackers to access data in other memory areas outside the specified boundary, or execute code that is stored outside the boundary memory location. This vulnerability is triggered by sending specially crafted data packets to TCP/1211.
 
Cve-2012-4705
Directory/path traversal vulnerability. The vulnerability occurs because the 3 S CoDeSys Gateway Server uses external input to construct a path name, but does not strictly verify the path name. As a result, attackers can bypass directory restrictions of the affected products.
 
Cve-2012-4706
Heap Buffer Overflow Vulnerability. The vulnerability is caused by the lax verification of a signed type variable by the 3 S CoDeSys Gateway Server. The vulnerability is triggered by sending specially crafted data packets to TCP/1211.
 
Cve-2012-4707
Buffer cross-border access (read and write) vulnerability. This vulnerability may cause attackers to execute arbitrary code, change the code execution process, and access sensitive information.
 
Cve-2012-4708
Stack Overflow Vulnerability. The vulnerability is triggered by sending specially crafted data packets to TCP/1211.
 
<* Source: Aaron Portnoy (aportnoy@ccs.neu.edu)

Link: http://secunia.com/advisories/52253/
Http://ics-cert.us-cert.gov/pdf/ICSA-13-050-01.pdf
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
3 S
--
The vendor has released a patch to fix this security problem. Please download 2.3.9.38 from the vendor's homepage:
 
Http://www.3s-software.com/index.shtml? En_CoDeSysV3_en