Rockwell RSLogix 19 - Denial of Service
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | Rockwell RSLogix 5000 RNA Denial of Service (CVE-2011-3489) | 24 Jan 201900:00 | – | checkpoint_advisories |
 | CVE-2011-3489 | 16 Sep 201114:00 | – | cve |
 | CVE-2011-3489 | 16 Sep 201114:00 | – | cvelist |
 | EUVD-2011-3452 | 7 Oct 202500:30 | – | euvd |
 | Rockwell RSLogix Overflow Vulnerability | 3 Jul 201106:00 | – | ics |
 | CVE-2011-3489 | 16 Sep 201114:28 | – | nvd |
 | Rockwellautomation Rslogix Improper Restriction of Operations within the Bounds of a Memory Buffer | 8 Nov 201900:00 | – | nessus |
| Rockwell (CVE-2011-3489) (deprecated) | 7 Feb 202200:00 | – | nessus |
 | Out-of-bounds | 16 Sep 201114:28 | – | prion |
#######################################################################
Luigi Auriemma
Application: Rockwell RSLogix
http://www.rockwellautomation.com/rockwellsoftware/design/rslogix5000/
Versions: <= 19 (RsvcHost.exe 2.30.0.23)
Platforms: Windows
Bug: Denial of Service
Exploitation: remote
Date: 13 Sep 2011
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
From vendor's website:
"With RSLogix 5000 programming software, you need only one software
package for discrete, process, batch, motion, safety and drive-based
application."
#######################################################################
======
2) Bug
======
RsvcHost.exe and RNADiagReceiver.exe listen on ports 4446 and others.
These services use RnaUtility.dll which doesn't handle the 32bit size
field located in the "rna" packets with results like a memset zero
overflow and invalid read access.
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/rslogix_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17843.zip
nc SERVER 4446 < rslogix_1a.dat
nc SERVER 4446 < rslogix_1b.dat
#######################################################################
======
4) Fix
======
No fix.
#######################################################################Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Sep 2011 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 25
EPSS0.08746