PT-2017-11422 · Osci · Osci Transport Library

Marc Nimmerrichter + 1 · Publicado 2017-06-30 · Atualizado 2017-07-06 · CVE-2017-10669

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OSCI Transport Library versions 1.6 through 1.6.1

Description The issue allows an attacker with access to unencrypted OSCI protocol messages to send crafted protocol messages with duplicate IDs, potentially exploiting the Signature Wrapping vulnerability in OSCI-Transport 1.2 as used in the OSCI Transport Library.

Recommendations For OSCI Transport Library versions 1.6 through 1.6.1, consider implementing encryption for OSCI protocol messages to prevent unauthorized access and mitigate the risk of exploitation. As a temporary workaround, restrict access to unencrypted OSCI protocol messages until a patch is available.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2017-10669

Produtos afetados

Osci Transport Library

Referências · 4

• http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html · Nota
• https://osv.dev/vulnerability/CVE-2017-10669 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-10669 · Nota de Segurança
• http://seclists.org/fulldisclosure/2017/Jun/44 · Nota