CVE-2019-5178: Buffer Overflow

Published Mar 11, 2020

Updated

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file. The destination buffer sp+0x440 is overflowed with the call to sprintf() for any hostname values that are greater than 1024-len(‘/etc/config-tools/changehostname hostname=‘) in length. A hostname value of length 0x3fd will cause the service to crash.

Affected Software

2 affected components

WAGO PFC200 Firmware=03.02.02\(14\)

WAGO PFC200

Event History

Mar 11, 2020

CVE Published

via MITRE·11:25 PM

Data Sourced

via MITRE·11:25 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2019-5178.

What is the severity of CVE-2019-5178?

The severity of CVE-2019-5178 is high with a severity value of 7.8.

Which software is affected by CVE-2019-5178?

The WAGO PFC 200 Firmware version 03.02.02(14) is affected by CVE-2019-5178.

How can an attacker exploit CVE-2019-5178?

An attacker can exploit CVE-2019-5178 by sending a specially crafted packet to trigger the parsing of a cache file.

Is WAGO PFC200 vulnerable to CVE-2019-5178?

No, WAGO PFC200 is not vulnerable to CVE-2019-5178.