CVE-2015-1521

High

Published: 24/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The DNP3 protocol analyzer in Bro before version 2.3.2 has an issue with handling zero values of packet length, which can lead to denial of service.

Risk Assessment

Remote attackers can exploit this vulnerability to cause buffer overflow or assertion failure, impacting system availability.

Recommendation

It is recommended to update Bro software to version 2.3.2 or later to mitigate this vulnerability.

Other vulnerabilities in Bro DNP3 protocol analyzer

CVE-2015-1522High
The DNP3 protocol analyzer in Bro before version 2.3.2 does not reject certain non-zero values of packet length, allowing remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.

Original NVD description (English source)

analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS