Published: 14/09/2018 Updated: 24/08/2020

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Buffer overflow in OPC UA applications allows remote malicious users to trigger a stack overflow with carefully structured requests.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opcfoundation unified architecture-java
opcfoundation unified architecture-.net-legacy
opcfoundation unified architecture ansic
opcfoundation unified architecture .net-standard
debian debian linux 9.0

Multiple vulnerabilities have been discovered in Wireshark, a network protocol analyzer, which could result in denial of service or the execution of arbitrary code For the stable distribution (stretch), these problems have been fixed in version 265-1~deb9u1 We recommend that you upgrade your wireshark packages For the detailed security status ...

Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests ...

A flaw has been discovered in wireshark >= 260 and < 264 in the OpcUa dissector where a specially crafted structured request could lead to stack overflow This could be used by an attacker to crash wireshark or execute arbitrary code on the affected host by injecting a malformed packet onto the wire or by convincing someone to read a mal ...

PoC for CVE-2018-12086 affecting various OPC UA stacks

CVE-2018-12086 PoC nvdnistgov/vuln/detail/CVE-2018-12086 opcfoundationorg/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2018-12086pdf TL;DR: some OPC UA stacks are vulnerable to a stack overflow when decoding specially crafted requests Build mvn clean package Run java -jar target/stack-overflow-pocjar <endpointUrl>

CWE-787 https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12086.pdf http://www.securityfocus.com/bid/105538 http://www.securitytracker.com/id/1041909 https://www.debian.org/security/2018/dsa-4359 http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html https://nvd.nist.gov https://www.debian.org/security/./dsa-4359 https://github.com/kevinherron/stack-overflow-poc

CVE-2018-12086

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect