nCipher netHSM Discloses Passphrases to Local and Remote Users
|
|
SecurityTracker Alert ID: 1010558 |
|
SecurityTracker URL: http://securitytracker.com/id/1010558
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 22 2004
|
Impact:
Disclosure of authentication information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.1 and prior versions
|
Description:
A vulnerability was reported in nCipher's netHSM. A physically local user can view passphrases in the log file. A remote user may be able to view passphrases.
nCipher reported that passphrases entered via the netHSM front panel's built-in thumbwheel or attached keyboard are recorded in the netHSM system log when debugging is enabled. Debugging was enabled in the netHSM front-panel software, the report said.
A remote user can view the log file (and the passphrases) via the front panel. In some cases, the log may be sent to a remote system, the vendor indicated. As a result, a remote user may be able to view the passphrases.
|
Impact:
A user with access to the front panel can view passphrases.
In some cases, a remote user can view passphrases.
|
Solution:
The vendor has released a fix, described at:
http://www.ncipher.com/support/advisories/advisory10.htm
|
Vendor URL: www.ncipher.com/support/advisories/advisory10.htm (Links to External Site)
|
Cause:
Access control error
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
