SB2017090103 - Denial of service in Siemens 7KM PAC Switched Ethernet
Published: September 1, 2017
Security Bulletin ID
SB2017090103
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Resource exhaustion (CVE-ID: CVE-2017-9945)
The vulnerability allows an adajacent attacker to cause DoS condition on the target system.The weakness exists in the Siemens 7KM PAC Switched Ethernet PROFINET expansion module due to input validation flaw. An adjacent attacker can send a specially crafted PROFINET DCP packet as a local Ethernet (Layer 2) broadcast, cause memory exhaustion and cause the application to restart.
Successful exploitation of the vulnerability results in denial of service.
Remediation
Install update from vendor's website.