Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that allows an unauthorized attacker to trigger a gradual degradation in performance.
Recommended action: Upgrade to 1.5.374.118 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This security update resolves a vulnerability in the OPC UA .NET Standard Stack that enables an unauthorized attacker to trigger a rapid increase in memory consumption.
Recommended action: Upgrade to 1.05.374.54 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application. Was ZDI-CAN-10295.
Recommended action: Upgrade to 1.4.359.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.
Recommended action: Upgrade to 1.3.352.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.
Recommended action: Upgrade to 1.4.353.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network infrastructure to decrypt passwords.
Recommended action: Upgrade to 1.4.353.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.