CVE-2017-10669
Last modified
CVE-2017-10669 is a vulnerability of currently unknown severity. Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs.. EPSS estimates a 0.49% chance of exploitation in the next 30 days.
Description
Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xoev | Osci Transport Library | 1.6 |
| Xoev | Osci Transport Library | 1.6.1 |
References
- http://seclists.org/fulldisclosure/2017/Jun/44Mailing List, Third Party Advisory
- http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.htmlTechnical Description, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/Jun/44Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-10669?
How severe is CVE-2017-10669?
How do I fix CVE-2017-10669?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-10662The sanity_check_raw_super function in fs/f2fs/super.c in th…7.8
- CVE-2017-10663The sanity_check_ckpt function in fs/f2fs/super.c in the Lin…7.8
- CVE-2017-10664qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIP…7.5
- CVE-2017-10665Directory traversal vulnerability in ajaxfileupload.php in K…
- CVE-2017-10667In index.php in Zen Cart 1.6.0, the products_id parameter ca…
- CVE-2017-10668A Padding Oracle exists in OSCI-Transport 1.2 as used in OSC…
- CVE-2017-1067Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-10670An XML External Entity (XXE) issue exists in OSCI-Transport …
- CVE-2017-10671Heap-based Buffer Overflow in the de_dotdot function in libh…7.8
- CVE-2017-10672Use-after-free in the XML-LibXML module through 2.0129 for P…9.8
- CVE-2017-10673admin/profile.php in GetSimple CMS 3.x has XSS in a name fie…6.1
- CVE-2017-10674Antiy Antivirus Engine 5.0.0.06281654 allows local users to …
Are you affected by CVE-2017-10669?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST