Heap-based Buffer Overflow in lib60870-C

Executive Summary

This vulnerability is a heap-based buffer overflow in lib60870-C version 2.4.0. It occurs when the server-side FileSegment ASDU encoding path processes file transfers. The issue arises because the FileSegment_encode function only checks the standalone segment length but fails to verify if the current ASDU frame has enough remaining capacity before writing data. This leads to writing beyond the allocated heap memory when multiple FileSegment objects are added to an ASDU.

Useful 0 Not Useful 0

Detection Guidance

Monitor for crashes or unexpected terminations in lib60870-C v2.4.0 server applications handling file-transfer ASDUs. Check logs for failed CS101_ASDU_addInformationObject calls or ASDU frame writer errors. Use network traffic analysis tools to inspect IEC 60870-5-101/104 protocol messages for malformed FileSegment objects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service or process termination on affected systems. It may allow remote attackers to crash server applications handling IEC 60870-5-101/104 protocols. Systems using lib60870-C 2.4.0 for power systems or SCADA networks are particularly at risk if they process file transfers via the vulnerable encoding path.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade lib60870-C to a patched version if available. If not, restrict network access to vulnerable servers, disable file-transfer features, or implement application-layer checks to validate ASDU payload space before adding FileSegment objects. Monitor for exploitation attempts.

Useful 0 Not Useful 0