libiec61850 vulnerabilities

libiec61850 version 1.6 contains a vulnerability in the parseGoosePayload() function in /goose/goose_receiver.c, allowing attackers to bypass authentication via a captured GOOSE frame.

In the MZ Automation libiec61850 library up to version 1.6.1, a heap-based buffer overflow vulnerability was found in the MmsMapping_varAccessSpecToObjectReference function in src/iec61850/common/iec61850_common.c of the MMS Protocol Workflow component. Manipulating the GetNamedVariableListAttributesResponse.itemId argument leads to overflow. The attack requires local access, and the exploit is public.

A heap-based buffer overflow vulnerability was found in MZ Automation libiec61850 up to 1.6.1 in the function SVReceiver_stopThreadless of src/sampled_values/sv_subscriber.c. The attack must be initiated locally and the exploit is public. Version 1.6.2 mitigates the issue.

Use-after-free vulnerability in MZ Automation libiec61850 up to 1.6.1, in the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c (URCB Revalidation component). The attack requires local access. The exploit has been made public. Upgrading to version 1.6.2 fixes the issue.

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. The function checkDataSetAccess in src/iec61850/server/mms_mapping/mms_mapping.c causes an out-of-bounds read. The attack can be initiated remotely. The exploit has been made public.

A heap overflow vulnerability was discovered in libiec61850 version 1.5 in the BerEncoder_encodeLength function at /asn1/ber_encoder.c. This flaw could allow an attacker to execute arbitrary code or cause a denial of service.