JFrog Security Research
< Back

XRAY-75756 - Unified Automation C++ based OPC UA Client Server SDK out of bounds read

JFrog Severity:medium

Discovered ByUriya Yavnieliof the JFrog Security Research Team

Published 1 Jun, 2022 | Last updated 1 Jun, 2022

The UaVariant::cloneTo() function in Unified Automation C++ based OPC UA Client Server SDK is vulnerable to NULL dereference which can allow a remote authenticated attacker to perform denial of service.

Unified Automation C++ based OPC UA Client Server SDK ​

Unified Automation C++ based OPC UA Client Server SDK (, 1.7.6], fixed in 1.7.7 ​

Unified Automation C++ based OPC UA Client Server SDK is a SDK used to develop an OPC UA server in C++, Developed by the Unified Automation.

There is a possible null deref in UaVariant::cloneTo():

…
      if ( source->Value.Matrix.NoOfDimensions > 0 )
      {
        copy->Value.Matrix.Dimensions = (int *)OpcUa_Memory_Alloc(4 * source->Value.Matrix.NoOfDimensions);
        memcpy(copy->Value.Matrix.Dimensions, source->Value.Matrix.Dimensions, 4 * source->Value.Matrix.NoOfDimensions);
        nMatrixElements = 1;
        for ( mm = 0; mm < copy->Value.Matrix.NoOfDimensions; ++mm )
          nMatrixElements *= source->Value.Matrix.Dimensions[mm];
…

There is a call to memcpy() after OpcUa_Memory_Alloc() is called without checking if copy->Value.Matrix.Dimensions is null. It might be null if the requested length is too big.

No PoC is supplied for this issue ​

No mitigations are supplied for this issue

< Back