BACnet Stack Out-of-Bounds Read Vulnerability in WriteProperty Request Handling

A length underflow vulnerability has been identified in the BACnet Stack library, specifically in versions prior to 1.5.0rc4 and 1.4.3rc2. The issue arises in the WriteProperty request handling, where the decoder fails to properly validate the length of the APDU. This flaw allows for a malformed or truncated APDU to cause an underflow, leading to an out-of-bounds read and a subsequent crash, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a process crash, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a malformed WriteProperty request that truncates the APDU. This can be done using a crafted BACnet message that exploits the length validation flaw in the 'wp_decode_service_request' function.

Remediation

Users can upgrade to BACnet Stack versions 1.5.0rc4 or 1.4.3rc2, where this vulnerability has been fixed.