nCipher nCore May Let Users Conduct Key Determination Attacks and May Fail to Detect MAC Message Modification
|
|
SecurityTracker Alert ID: 1015718
|
|
SecurityTracker URL: http://securitytracker.com/id?1015718
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Updated: Mar 7 2006
|
Original Entry Date: Mar 3 2006
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Description: Two vulnerabilities were reported in nCipher nCore. Modified messages may not be properly detected in certain cases. A user may be able to conduct key determination attacks.
The nCore API may not properly calculate and verify CBC MACs to detect modifications to ostensibly protected messages.
The nCore
code base also contains some features that may reduce the amount of effort required for a user to determine key values.
|
Impact: Modified messages may not be properly detected in certain cases.
A user may be able to conduct key determination attacks.
|
Solution: The vendor has issued a fix. Updated firmware is available for all nFast/CA, nFast/KM, nForce, nShield, and netHSM modules and for
the payShield, DSE, and TSMC products.
The vendor's advisories are available at:
http://www.ncipher.com/support/advisories/keysigs/advis13.txt.asc
http://www.nciph
er.com/support/advisories/keysigs/advis14.txt.asc
|
Vendor URL: www.ncipher.com/support/advisories/keysigs/advis13.txt.asc (Links to External Site)
|
Cause: State error
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
