Out-of-Bounds Read in open62541 OPC UA Client

Executive Summary

This vulnerability is an out-of-bounds read issue in the open62541 library version 1.5.5. It occurs in the client-side function responseReadNamespacesArray() located in src/client/ua_client_connect.c. An out-of-bounds read means the program reads data outside the intended memory buffer, which could expose sensitive information or cause crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running open62541 version 1.5.5 or earlier. Use commands like 'ua-netstat -v' or inspect server logs for client connection attempts that may trigger the out-of-bounds read in responseReadNamespacesArray().

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read memory contents outside the intended buffer, potentially exposing sensitive data or causing denial-of-service conditions. Since it affects client-side operations, systems using open62541 for OPC UA client functionality may be at risk.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is an out-of-bounds read in open62541 1.5.5, which could potentially expose sensitive data or disrupt system operations. This may impact compliance with GDPR by risking unauthorized data access or processing, and with HIPAA by compromising the integrity of protected health information. However, specific compliance impacts depend on system configuration and deployment.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade open62541 to a version newer than 1.5.5 to address the out-of-bounds read issue. If upgrading is not immediately possible, restrict network access to the vulnerable service or disable client connections until patched.

Useful 0 Not Useful 0