CVE-2020-27274
First published: Tue Jan 26 2021(Updated: )
Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead to a denial-of-service condition on the OPC UA Tunneller (versions prior to 6.3.0.8233).
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Honeywell Opc Ua Tunneller | <6.3.0.8233 | |
| Matrikon, a subsidiary of Honeywell OPC UA Tunneller | <6.3.0.8233 | 6.3.0.8233 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-27274?
CVE-2020-27274 is a vulnerability in the parsing functions of the Honeywell OPC UA Tunneller that can lead to a denial-of-service condition.
What is the severity of CVE-2020-27274?
CVE-2020-27274 has a severity rating of 7.5, which is considered high.
How does CVE-2020-27274 affect the Honeywell OPC UA Tunneller?
CVE-2020-27274 affects versions prior to 6.3.0.8233 of the Honeywell OPC UA Tunneller.
How can the denial-of-service condition be triggered by CVE-2020-27274?
The denial-of-service condition can be triggered when parsing functions in the affected product do not check the return value of malloc, leading to the forced closure of the thread handling the message.
Is there a fix available for CVE-2020-27274?
Yes, the fix for CVE-2020-27274 is to update the Honeywell OPC UA Tunneller to version 6.3.0.8233 or later.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/honeywell
- canonical/honeywell opc ua tunneller
- vendor/matrikon, a subsidiary of honeywell
- canonical/matrikon, a subsidiary of honeywell opc ua tunneller