PT-2020-10062 · Opc Foundation · Opc Ua .Net Standard Stack

Published 2020-03-16 · Updated 2021-07-21 · CVE-2019-19135

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OPC Foundation OPC UA .NET Standard codebase versions 1.4.357.28 through 1.4.359.30

Description The issue allows man-in-the-middle attackers to reuse encrypted user credentials sent over the network due to insufficiently random numbers created by servers. This affects scenarios where the SecurityPolicy is None and username/password or X509-based authentication is used, particularly when the server has a defect causing it to send null/empty or zeroed nonces.

Recommendations For versions 1.4.357.28 through 1.4.359.30, update to version 1.4.359.31 or later to resolve the issue. As a temporary workaround, consider avoiding the use of username/password or X509-based authentication with a SecurityPolicy of None until the update is applied.

Fix

Use of Insufficiently Random Values

Insufficiently Protected Credentials

Weakness Enumeration

CWE-330

CWE-522

Related Identifiers

CVE-2019-19135

GHSA-PQ4W-QM9G-QX68

Affected Products

Opc Ua .Net Standard Stack

References · 8

• https://opcfoundation.org/security-bulletins · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19135 · Vendor Advisory
• https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pq4w-qm9g-qx68 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19135 · Security Note
• https://github.com/eclipse/milo/security/advisories/GHSA-pq4w-qm9g-qx68 · Note
• https://github.com/eclipse/milo/commit/cac0e710bf2b8bed9c602fc597e9de1d8903abed · Note
• https://t.me/cvenotify/1742 · Telegram Post