CVE-2011-3489 RnaUtility.dll in RsvcHost.exe 2.30.0.23 in Rockwell RSLogix 19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted rna packet with a long string to TCP port 4446 th...
MediumCVSS 5.0
EPSS 8.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
RnaUtility.dll in RsvcHost.exe 2.30.0.23 in Rockwell RSLogix 19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted rna packet with a long string to TCP port 4446 that triggers (1) "a memset zero overflow" or (2) an out-of-bounds read, related to improper handling of a 32-bit size field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rockwellautomation rslogix | <= 19 | No fix listed |
References
- aluigi.altervista.org exploit
- 8383 third-party-advisory
- 49608 vdb-entry
- rslogix-rna-dos(69808) vdb-entry