CVE-2021-32979 : Exploit Details and Defense Strategies

A null pointer dereference vulnerability was discovered in the AVEVA SuiteLink server while processing specific commands. This CVE affects multiple AVEVA software products, leading to a high severity impact.

Understanding CVE-2021-32979

CVE-2021-32979 is a vulnerability that can be exploited by attackers to cause a denial of service (DoS) condition in affected systems running vulnerable versions of AVEVA software.

What is CVE-2021-32979?

The CVE-2021-32979 vulnerability involves a null pointer dereference in the SuiteLink server during the processing of commands 0x04/0x0a, which could allow a remote attacker to exploit this flaw and impact the availability of the affected systems.

The Impact of CVE-2021-32979

With a CVSS base score of 7.5 (high severity), this vulnerability poses a significant risk due to its potential to cause a system crash or unresponsive state, leading to service disruption and downtime.

Technical Details of CVE-2021-32979

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability is categorized as a null pointer dereference flaw in the AVEVA SuiteLink server. The issue arises during the handling of specific commands, potentially leading to a DoS condition.

Affected Systems and Versions

Multiple AVEVA software products are impacted by this vulnerability, including AVEVA System Platform 2020, AVEVA InTouch 2020, AVEVA Historian 2020, AVEVA Communication Drivers Pack 2020, AVEVA Batch Management 2020, and AVEVA MES 2014. These products are affected by specific versions mentioned in the CVE details.

Exploitation Mechanism

The vulnerability can be exploited remotely by sending crafted commands to the SuiteLink server, triggering the null pointer dereference condition and potentially causing the server to become unresponsive.

Mitigation and Prevention

To address CVE-2021-32979, organizations and users can take the following steps.

Immediate Steps to Take

Evaluate the impact of the vulnerabilities based on the operational environment and product architecture.
Apply the recommended security updates provided by AVEVA for the affected software versions.

Long-Term Security Practices

Regularly monitor for security advisories and updates from AVEVA and other software vendors.
Implement network segmentation and access controls to reduce the attack surface.

Patching and Updates

Ensure that affected software products are updated with the latest security patches and configurations. Refer to AVEVA security bulletin AVEVA-2021-003 for detailed information on the patches and mitigation strategies.