Tenable Research Advisory: Rockwell Automation RSLinx Classic Lite RCE and DoS Vulnerability Discovered by Tenable
Tenable Research has discovered multiple memory corruption issues in Rockwell Automation RSLinx Classic Lite 4.00.01 that may allow for remote code execution or denial of service. Customers are encouraged to update their software.
|
What do you need to know? Rockwell Automation RSLinx Classic could allow for memory corruption and remote code execution or denial of service. Whatโs the attack vector? Common industrial protocol messages over port 44818 to the RSLINX.exe service. Whatโs the business impact? Memory corruption and remote code execution could lead to malicious takeover of an asset. Whatโs the solution? Apply the latest update from Rockwell Automation for RSLinx Classic. |
Background
While researching methods for remotely identifying Rockwell Automation RSLinx Classic, Tenable Research found multiple memory corruption issues in RSLinx Classic Lite 4.00.01 (CVE-2018-14829 and CVE-2018-14821), which may allow an unauthenticated remote attacker to achieve remote code execution (RCE) or denial of service (DoS).
๋ถ์
RSLinx Classic Lite (RSLINX.exe) implements EtherNet/IP, which encapsulates common industrial protocol (CIP) messages. Due to RSLINX.exe not checking various CIP length fields against the number of received network data bytes thoroughly, an unauthenticated remote attacker can exploit this via port 44818 to cause memory corruption issues.
Within the buffer overflow caused through this exploit, an attacker can then trigger arbitrary code execution.
Vendor response
Rockwell Automation has released software patches for RSLinx Classic versions V3.60, V3.74, V3.80, V3.81, V3.90 and V4.00.01.
Solution
According to Rockwell Automationโs advisory, customers are strongly encouraged to update their software. They have also recommended customers disable port 44818 in RSLinx Classic if it is not utilized during system operation. Customers should also follow other security best practices like limiting administrator privileges and blocking all traffic to EtherNet/IP or other CIP-based devices from external sources.
Identifying affected systems
Tenable has released the following plugin to detect these vulnerabilities.
|
Plugin ID |
Description |
|
Rockwell Automation RSLinx Classic <= 4.00.01 Multiple Vulnerabilities |
Get more information
Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
๊ด๋ จ ๊ธฐ์ฌ
Tenable Cloud Security Study Reveals a Whopping 95% of Surveyed Organizations Suffered a Cloud-Related Breach Over an 18-Month Period
May 14, 2024The finding from the Tenable 2024 Cloud Security Outlook study is a clear sign of the need for proactive and robust cloud security. Read on to learn more about the studyโs findings, including the main challenges cloud security teams face, their strategies for better protecting their cloud infrastructure and the tools they use to measure success.
Shifting the Paradigm: Why the Cyber Insurance Industry Should Focus on Preventive Security
May 13, 2024As claims and losses climb, itโs clear that preventive security should be prioritized more when designing a cyber insurance policy. Hereโs why preventive security investments are cost effective and can lead to lower premiums.
Cybersecurity Snapshot: New Guide Explains How To Assess if Software Is Secure by Design, While NIST Publishes GenAI Risk Framework
May 10, 2024Is the software your company wants to buy securely designed? A new guide outlines how you can find out. Meanwhile, a new NIST framework can help you assess your GenAI systemsโ risks. Plus, a survey shows a big disconnect between AI usage (high) and AI governance (low). And MITREโs breach post-mortem brims with insights and actionable tips. And much more!
