"3S-Smart.CODESYS.CmpRouter.CmpRouterEmbedded.Integer.Overflow"

特征库ID：
48912
漏洞级别：
high
CVE ID：
CVE-2019-5105
建议的动作：
drop
受影响的系统：
Other
协议：
tcp

攻击漏洞描述

这表明攻击企图利用智能软件解决方案 CODESYS V3 模拟运行时（CODESYS 开发系统的一部分）中的整数溢出漏洞。该漏洞是由于对用户提供的数据的验证不当造成的。未经身份验证的远程攻击者可以通过向目标服务器发送精心制作的消息来利用此漏洞。成功利用可以让攻击者在 SYSTEM/root 的安全上下文下执行任意代码。

影响范围

Smart Software Solutions CoDeSys Control for BeagleBone prior to V3.5.15.40 Smart Software Solutions CoDeSys Control for empPC-A/iMX6 prior to V3.5.15.40 Smart Software Solutions CoDeSys Control for IOT2000 prior to V3.5.15.40 Smart Software Solutions CODESYS Control for Linux prior to V3.5.15.40 Smart Software Solutions CoDeSys Control for PFC100 prior to V3.5.15.40 Smart Software Solutions CoDeSys Control for PFC200 prior to V3.5.15.40 Smart Software Solutions CoDeSys Control for PLCnext prior to V3.5.15.40 Smart Software Solutions CoDeSys Control for Raspberry Pi prior to V3.5.15.40 Smart Software Solutions CoDeSys Control RTE V3 prior to V3.5.15.40 Smart Software Solutions CoDeSys Control RTE V3 (for Beckhoff CX) prior to V3.5.15.40 Smart Software Solutions CoDeSys Control V3 Runtime System Tookit prior to V3.5.15.40 Smart Software Solutions CoDeSys Control Win V3 (also part of the CODESYS Development System Setup) prior to V3.5.15.40 Smart Software Solutions CODESYS Edge Gateway V3 prior to V3.5.15.40 Smart Software Solutions CODESYS Gateway V3 prior to V3.5.15.40 Smart Software Solutions CoDeSys HMI V3 prior to V3.5.15.40 Smart Software Solutions CODESYS OPC Server V3 prior to V3.5.15.40 Smart Software Solutions CODESYS PLCHandler SDK prior to V3.5.15.40 Smart Software Solutions CoDeSys V3 Embedded Target Visu Toolkit prior to V3.5.15.40 Smart Software Solutions CoDeSys V3 Remote Target Visu Toolkit prior to V3.5.15.40 Smart Software Solutions CODESYS V3 Simulation Runtime (part of the CODESYS Development System) prior to V3.5.15.40