CVE-2020-8867: (Pwn2Own) OPC Foundation UA .NET Standard CreateSessionRequest Race Condition Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application. Was ZDI-CAN-10295.
Other sources
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-8867?
CVE-2020-8867 is a vulnerability in OPC Foundation UA .NET Standard 1.04.358.30 that allows remote attackers to create a denial-of-service condition.
How severe is CVE-2020-8867?
CVE-2020-8867 has a severity rating of 7.5 (high).
How does CVE-2020-8867 affect OPC Foundation UA .NET Standard?
CVE-2020-8867 affects OPC Foundation UA .NET Standard 1.04.358.30 installations.
Is authentication required to exploit CVE-2020-8867?
No, authentication is not required to exploit CVE-2020-8867.
Are there any references related to CVE-2020-8867?
Yes, you can find more information about CVE-2020-8867 in the OPC Foundation Security Bulletin and the Zero Day Initiative advisory.