RSLinx Classic ENGINE.dll Code Execution

The vulnerability of the ENGINE.dll file in the RSLinx Classic communication server is caused by buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure by sending specially crafted CIP Common Industrial Protocol...

PT-2018-1592

Name of the Vulnerable Software and Affected Versions Rockwell Automation RSLinx Classic versions 4.00.01 and prior Description The issue allows a remote threat actor to send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. It also has the...

Source引擎reason参数格式串漏洞

Source引擎是一个三维的游戏引擎，由Valve软件公司为第一人称射击游戏半条命2开发，并且对其他的游戏开发者开放授权。 Source引擎的engine.dll库中包含一个用于处理玩家断开连接（playerdisconnect）的函数，当踢出玩家时显示控制台消息“Dropped NICKNAME from server REASON”。这里的reason参数通常是用于解释踢出玩家理由的服务器端参数。在函数的开始处snprintf使用了inputreasonstring用于生成会在控制台消息中所显示的最终理由，但类似于以下的示例中没有指定必要的格式参数（%s）：...