nCipher Insecure CBC-MAC API Vulnerability

Bugtraq ID:	17011
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 07 2006 12:00AM
Updated:	Mar 10 2006 12:55AM
Credit:	The vendor disclosed this issue.
Vulnerable:	nCipher nCore 0 nCipher nCipher Software CD 0
Not Vulnerable:	nCipher nCipher Software CD 9.0

nCipher Insecure CBC-MAC API Vulnerability

Certain nCipher products are susceptible to an insecure CBC-MAC (Cipher Block Chaining-Message Authentication Code) API vulnerability. This issue is due to a flaw in the API that allows programmers to use insecure CBC-MAC IVs (Initialization Vector).

This issue allows remote attackers to modify data that is protected by the affected CBC-MAC protocol. This allows attackers to perform man-in-the-middle attacks against software that uses the affected insecure APIs. Other attacks may also be possible.

nCipher Insecure CBC-MAC API Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

nCipher Insecure CBC-MAC API Vulnerability

Solution:
The vendor has released an advisory, along with fixes to address this issue. Please see the referenced advisory for further information.

nCipher Insecure CBC-MAC API Vulnerability

References:

• nCipher Homepage (nCipher)
  
• nCipher Security Advisory No. 13: CBC-MAC IV misleading programming interface (nCipher)