Buffer Overflow in open62541 OPC UA Server via LDS Multicast Discovery

Executive Summary

This is a Buffer Overflow vulnerability in open62541 version 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled. An unauthenticated remote attacker can exploit it by sending a RegisterServer or RegisterServer2 request with many unique discoveryUrls, causing a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual network traffic targeting the Local Discovery Server (LDS) with many unique discoveryUrls. Check for repeated RegisterServer or RegisterServer2 requests from unauthenticated sources. Use network monitoring tools like Wireshark to capture and analyze OPC UA traffic for malformed or excessive requests.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows remote attackers to crash the system by causing a buffer overflow, leading to a denial of service. This can disrupt services relying on the open62541 library, especially if multicast discovery is enabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the Local Discovery Server (LDS) due to a buffer overflow. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR or HIPAA. However, a denial of service could impact availability of services, potentially leading to compliance issues if critical systems become inaccessible.

Useful 0 Not Useful 0

Mitigation Strategies

Disable multicast discovery in the LDS configuration if not required. Update open62541 to a patched version if available. Restrict network access to the LDS port (default 4840) using firewalls. Monitor logs for suspicious RegisterServer requests and block offending IPs.

Useful 0 Not Useful 0