goToMain libosdp up to 2.x message integrity

Summaryinfo

A vulnerability, which was classified as problematic, has been found in goToMain libosdp up to 2.x. Impacted is an unknown function. Performing a manipulation results in message integrity. This vulnerability was named CVE-2024-52288. The attack needs to be approached locally. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in goToMain libosdp up to 2.x. It has been classified as problematic. This affects an unknown functionality. The manipulation with an unknown input leads to a message integrity vulnerability. CWE is classifying the issue as CWE-924. The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission. This is going to have an impact on confidentiality. The summary by CVE is:

libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. In affected versions an unexpected `REPLY_CCRYPT` or `REPLY_RMAC_I` may be introduced into an active stream when they should not be. Once RMAC_I message can be sent during a session, attacker with MITM access to the communication may intercept the original RMAC_I reply and save it. While the session continues, the attacker will record all of the replies and save them, till capturing the message to be replied (can be detected by ID, length or time based on inspection of visual activity next to the reader) Once attacker captures a session with the message to be replayed, he stops resetting the connection and waits for signal to perform the replay to of the PD to CP message (ex: by signaling remotely to the MIMT device or setting a specific timing). In order to replay, the attacker will craft a specific RMAC_I message in the proper seq of the execution, which will result in reverting the RMAC to the beginning of the session. At that phase - attacker can replay all the messages from the beginning of the session. This issue has been addressed in commit `298576d9` which is included in release version 3.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-52288 since 11/06/2024. The exploitability is told to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 3.0.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• goToMain

Name

• libosdp

Version

• 2.x

Website

• Product: https://github.com/goToMain/libosdp/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion