CVE-2017-6025 Memory corruption in 3S-Smart Software Solutions GmbH CODESYS Web Server
A stack buffer overflow in CODESYS Web Server allows attackers to execute arbitrary code or crash the application via malicious XML input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6025?
CVE-2017-6025 is a critical memory corruption vulnerability in 3S-Smart Software Solutions GmbH CODESYS Web Server, published on 19 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Stack Buffer Overflow issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A malicious user could overflow the stack buffer by providing overly long strings to functions that handle the XML. Because the function does not verify string size before copying to memory, the attacker may then be able to crash the application or run arbitrary code.
Which versions are affected by CVE-2017-6025?
It affects 1 product.
Products include Codesys Web Server.
How do I fix CVE-2017-6025?
No fix has been published for CVE-2017-6025 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-6025 being exploited?
There is no known exploitation of CVE-2017-6025 in the wild and no public exploit code.
Other vulnerabilities in 3S-Smart Software Solutions GmbH CODESYS Web Server
Sources
Also known as GHSA-86wq-qm2r-82w8.