SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   nCipher nCore Vendors:   nCipher
nCipher nCore May Let Users Conduct Key Determination Attacks and May Fail to Detect MAC Message Modification
SecurityTracker Alert ID:  1015718
SecurityTracker URL:  http://securitytracker.com/id/1015718
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Updated:  Mar 7 2006
Original Entry Date:  Mar 3 2006
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Two vulnerabilities were reported in nCipher nCore. Modified messages may not be properly detected in certain cases. A user may be able to conduct key determination attacks.

The nCore API may not properly calculate and verify CBC MACs to detect modifications to ostensibly protected messages.

The nCore code base also contains some features that may reduce the amount of effort required for a user to determine key values.

Impact:   Modified messages may not be properly detected in certain cases.

A user may be able to conduct key determination attacks.

Solution:   The vendor has issued a fix. Updated firmware is available for all nFast/CA, nFast/KM, nForce, nShield, and netHSM modules and for the payShield, DSE, and TSMC products.

The vendor's advisories are available at:

http://www.ncipher.com/support/advisories/keysigs/advis13.txt.asc
http://www.ncipher.com/support/advisories/keysigs/advis14.txt.asc

Vendor URL:  www.ncipher.com/support/advisories/keysigs/advis13.txt.asc (Links to External Site)
Cause:   State error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC