CVE-2018-7559: Medium severity opcfoundation Ua-.net-legacy vulnerability
An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2018-7559.
What is the severity level of CVE-2018-7559?
The severity level of CVE-2018-7559 is medium (5.3).
What software is affected by CVE-2018-7559?
The OPC UA .NET Legacy Stack and Sample Code (up to version 1.03.342) and the OPC UA .NET Standard Stack and Sample Code (up to version 1.03.352.10) are affected by CVE-2018-7559.
How can an attacker exploit CVE-2018-7559?
An attacker can exploit CVE-2018-7559 by sending crafted messages to an OPC UA Server, allowing them to determine the Server's private key.
Are there any references for more information on CVE-2018-7559?
Yes, you can find more information on CVE-2018-7559 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/108688), [GitHub commit for OPC UA .NET Legacy Stack and Sample Code](https://github.com/OPCFoundation/UA-.NET-Legacy/commit/e2a781b38efb8686d2bd850c2f2372b5c670bc45), [GitHub commit for OPC UA .NET Standard Stack and Sample Code](https://github.com/OPCFoundation/UA-.NETStandard/commit/ebcf026a54dd0c9052cff009d96d827ac923d150).