PT-2017-11422 · Osci · Osci Transport Library

Marc Nimmerrichter + 1 · Published 2017-06-30 · Updated 2017-07-06 · CVE-2017-10669

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OSCI Transport Library versions 1.6 through 1.6.1

Description The issue allows an attacker with access to unencrypted OSCI protocol messages to send crafted protocol messages with duplicate IDs, potentially exploiting the Signature Wrapping vulnerability in OSCI-Transport 1.2 as used in the OSCI Transport Library.

Recommendations For OSCI Transport Library versions 1.6 through 1.6.1, consider implementing encryption for OSCI protocol messages to prevent unauthorized access and mitigate the risk of exploitation. As a temporary workaround, restrict access to unencrypted OSCI protocol messages until a patch is available.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2017-10669

Affected Products

Osci Transport Library

References · 4

• https://osv.dev/vulnerability/CVE-2017-10669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10669 · Security Note
• http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html · Note
• http://seclists.org/fulldisclosure/2017/Jun/44 · Note