Apache PLC4X vulnerabilities

A vulnerability in the Go implementation of Apache PLC4X (PLC4Go) involves improper verification of the source of a communication channel during ADS discovery. An attacker can send a spoofed UDP datagram to the discovering host, redirecting subsequent connections to an arbitrary address. The connection address is derived from the AmsNetId in the response body rather than the datagram's actual source. Additionally, a single malformed datagram can disable discovery listeners in both PLC4Go and PLC4J implementations, causing panics, exceptions, or infinite loops.

The Go implementation of Apache PLC4X (PLC4Go) contains multiple severe defects, including integer overflow, improper validation of array indices, uncontrolled recursion, and memory allocation with excessive size values. A malicious device or an attacker able to inject network traffic can crash or exhaust the memory of the client application, causing a denial of service.

A vulnerability in Apache PLC4X (Java implementation, PLC4J) allows a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the OPC UA driver, these defects are reachable before authentication, during secure channel and session establishment, before the server's identity is bound. Affects versions 0.10.0 through 0.13.1.

The OPC UA driver in Apache PLC4X (PLC4J) improperly verifies cryptographic signatures and server certificates. An attacker in a network position between client and server can impersonate the OPC UA server and read, forge, or modify secure-channel traffic, including user credentials sent by the client. The issue affects versions 0.9.0 through 0.13.1 and is fixed in version 1.0.0.