PT-2018-3556 · Opc Foundation · Opc Ua .Net Legacy Stack+1

Published 2018-06-13 · Updated 2019-06-10 · CVE-2018-7559

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OPC UA .NET Standard Stack and Sample Code versions before GitHub commit 2018-04-12 OPC UA .NET Legacy Stack and Sample Code versions before GitHub commit 2018-03-13

Description: A vulnerability in OPC UA applications allows a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack. The issue is related to errors in managing cryptographic keys, which can allow an attacker to disclose protected information.

Recommendations: For OPC UA .NET Standard Stack and Sample Code versions before GitHub commit 2018-04-12, update to a version after GitHub commit 2018-04-12 to resolve the issue. For OPC UA .NET Legacy Stack and Sample Code versions before GitHub commit 2018-03-13, update to a version after GitHub commit 2018-03-13 to resolve the issue.

Fix

Weakness Enumeration

CWE-320

Related Identifiers

BDU:2020-04651

CVE-2018-7559

GHSA-GR4C-5RQ6-CGH3

Affected Products

Opc Ua .Net Legacy Stack

Opc Ua .Net Standard Stack

References · 11

• https://github.com/OPCFoundation/UA-.NETStandard/commit/ebcf026a54dd0c9052cff009d96d827ac923d150 · Patch
• https://github.com/OPCFoundation/UA-.NET-Legacy/commit/e2a781b38efb8686d2bd850c2f2372b5c670bc45 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-7559 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7559 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04651 · Security Note
• https://osv.dev/vulnerability/GHSA-gr4c-5rq6-cgh3 · Vendor Advisory
• https://github.com/OPCFoundation/UA-.NETStandard · Note
• https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-7559.pdf · Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 · Note
• http://securityfocus.com/bid/108688 · Note
• https://github.com/advisories/GHSA-gr4c-5rq6-cgh3 · Note