Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Device (Encryption/VPN)  >   nCipher Hardware Security Module Vendors:   nCipher, Thales e-Security
Thales nShield Connect and nShield Connect+ USB Port Lets Physically Local Users Take Unauthorized Actions
SecurityTracker Alert ID:  1032152
SecurityTracker URL:
CVE Reference:   CVE-2015-1878   (Links to External Site)
Date:  Apr 17 2015
Impact:   Disclosure of authentication information, Modification of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 11.70 and prior
Description:   A vulnerability was reported in Thales nShield Connect and nShield Connect+. A physically local user can take unauthorized actions on the target system.

A physically local user can connect to the USB port on the front panel and perform unauthorized actions using previously loaded keys (e.g., sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on the network, and affect the integrity and confidentiality of newly created keys.]

The vendor notes that the local user cannot obtain user keys or bypass access control list restrictions.

nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ are affected.

nShield Edge, Solo, Solo+, and legacy netHSMs are not affected.

[Editor's note: This product is formerly known as nCipher nShield Connect.]

Impact:   A physically local user can perform unauthorized actions using previously loaded keys.
Solution:   The vendor has issued a fix (11.72; Advisory TESA-2015-001).
Vendor URL: (Links to External Site)
Cause:   Access control error

Message History:   None.

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC