IEC 60870-5-104 Buffer Overflow in I-frame Parsing

Executive Summary

This vulnerability involves a crafted IEC 60870-5-104 I-frame that declares an object count exceeding the space available in the ASDU body. This causes a function to read one byte past the end of a heap-allocated message buffer, potentially leading to memory corruption or crashes.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a crafted IEC 60870-5-104 I-frame with an object count exceeding buffer limits. Detection requires monitoring network traffic for malformed IEC 60870-5-104 packets or unusual object counts in ASDU bodies. Use protocol analyzers like Wireshark with IEC 60870-5-104 dissectors to inspect traffic for invalid frames.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could allow an attacker to cause denial-of-service conditions or execute arbitrary code on systems processing IEC 60870-5-104 traffic. This may disrupt critical infrastructure operations relying on this protocol.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves a buffer overflow in IEC 60870-5-104 I-frame parsing, which could lead to memory corruption or crashes. While not directly tied to GDPR or HIPAA, such vulnerabilities may impact compliance by exposing systems to unauthorized access or data integrity issues if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update or patch the affected IEC 60870-5-104 protocol implementation to handle malformed I-frames correctly. Monitor network traffic for unusual IEC 60870-5-104 frames with excessive object counts. Disable or restrict network access to systems using this protocol if patches are unavailable.

Useful 0 Not Useful 0