Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption Vulnerability

Bugtraq ID:	45974
Class:	Design Error
CVE:	CVE-2010-4709
Remote:	Yes
Local:	No
Published:	Jan 25 2011 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	Jeremy Brown
Vulnerable:	Automated Solutions Modbus/TCP Master OPC Server 0
Not Vulnerable:

Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption Vulnerability

Automated Solutions Modbus/TCP OPC Server is prone to a remote heap-based memory-corruption vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/45974.py

Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption Vulnerability

References:

• Automated Solutions Homepage (Automated Solutions)
  
• Automated Solutions Modbus/TCP OPC Server Homepage (Automated Solutions)
  
• Security Patch for OPC Server (Automated Solutions)
  
• Automated Solutions Modbus/TCP OPC Server Security Release Note (Automated Solutions)