Informazioni sul CVE-2021-43083
Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response
CWE ID: CWE-119
Base Score (CVSS): N/A
CVE: CVE-2021-43083
Descrizione: Apache PLC4X – PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.
Vettore di attacco
Punteggio CVSS
Il CVSS è un sistema di valutazione che misura la gravità di una vulnerabilità informatica considerando fattori come l’impatto potenziale, la probabilità di attacco e la facilità di esecuzione.
Riassunto: .
Dettaglio del Vettore
| Metrica | Valore | Significato | Descrizione |
|---|
Riferimenti esterni
- https://lists.apache.org/thread/jxx6qc84z60xbbhn6vp2s5qf09psrtc7
- http://www.openwall.com/lists/oss-security/2021/12/20/2
Prodotti interessati
- Apache Software Foundation – Apache PLC4X
Relazioni con altri prodotti
Produttore:Apache Software Foundation
Prodotto: Apache PLC4X
Anno: 2021
CWE: CWE-119
CVSS: 0.0