CVE-2008-2005 The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference an...
MediumCVSS 5.0
EPSS 16.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413, which causes a memory allocation failure.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wonderware intouch | = 8.0 | No fix listed |
| wonderware suitelink | = 2.0 | No fix listed |
References
- 30063 third-party-advisory
- www.coresecurity.com exploit
- VU#596268 third-party-advisory us-government-resource
- 20080505 CORE-2008-0129 - Wonderware SuiteLink Denial of Service vulnerability mailing-list
- 28974 vdb-entry
- 1019966 vdb-entry
- suitelinkservice-slssvc-dos(42221) vdb-entry
- 6474 exploit