CVE-2015-1522

High

Published: 24/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The DNP3 protocol analyzer in Bro before version 2.3.2 does not reject certain non-zero values of packet length, allowing remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.

Risk Assessment

Attackers may exploit this vulnerability to disrupt system operations, potentially leading to downtime in critical services.

Recommendation

It is recommended to upgrade to Bro version 2.3.2 or later to mitigate this vulnerability.

Other vulnerabilities in Bro DNP3 protocol analyzer

CVE-2015-1521High
The DNP3 protocol analyzer in Bro before version 2.3.2 has an issue with handling zero values of packet length, which can lead to denial of service.

Original NVD description (English source)

analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS