CVE-2008-2005 Null dereference in n/a
Remote attackers can cause denial of service or execute arbitrary code via a large length value in a Registration packet to TCP port 5413.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-2005?
CVE-2008-2005 is a medium-severity vulnerability in n/a, published on 6 May 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413, which causes a memory allocation failure.
Weakness: CWE-399
Which versions are affected by CVE-2008-2005?
It affects 2 products.
Products include Wonderware Intouch, Wonderware Suitelink.
How do I fix CVE-2008-2005?
No fix has been published for CVE-2008-2005 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-2005 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-2005 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-r887-hfp4-4397.