IOServer Resource Exhaustion Vulnerability

CVEs (1)

Remediations

• DNP3 Application Note AN2013-004b Validation of Incoming DNP3 Data, published August 13, 2014, addresses this issue. This bulletin may be downloaded at URL: (https://www.dnp.org/DNP3Downloads/AN2013-004b%20Validation%20of%20Incoming%20DNP3%20Data.pdf)
• IOServer has produced a new version that mitigates the vulnerability. The new version, Beta2112.exe, is available for download here: (http://www.ioserver.com/)
• Remote devices should not return a variation of 0 to a master, and a master that encounters a zero length message from a remote is suppose to stop processing that message.

Affected Vendors

Affected Products (1)