nCipher Testing Options Insecure Key Generation Vulnerabilities
BID:17012
Info
nCipher Testing Options Insecure Key Generation Vulnerabilities
| Bugtraq ID: | 17012 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 07 2006 12:00AM |
| Updated: | Mar 10 2006 12:20AM |
| Credit: | The vendor disclosed this issue. |
| Vulnerable: |
nCipher Time Source Master Clock 0 nCipher SecureDB 0 nCipher payShield nCipher nShield nCipher nForce nCipher netHSM 2.1.12 cam5 nCipher netHSM 2.1 nCipher netHSM 2.0 nCipher nCore 0 nCipher DSE200 Document Sealing Engine 0 |
| Not Vulnerable: | |
Discussion
nCipher Testing Options Insecure Key Generation Vulnerabilities
Certain nCipher products are susceptible to insecure key-generation vulnerabilities. These issues are due to the unintended inclusion of testing functionality in the affected software.
These issues may result in the creation of cryptographic keys that may have properties that allow attackers to recover the private key in significantly less time than with brute-force attacks.
By gaining access to private keys, attackers may gain access to potentially sensitive information, perform man-in-the-middle attacks, or bypass security restrictions that depend on the security properties of the affected keys. Other attacks may also be possible.
Certain nCipher products are susceptible to insecure key-generation vulnerabilities. These issues are due to the unintended inclusion of testing functionality in the affected software.
These issues may result in the creation of cryptographic keys that may have properties that allow attackers to recover the private key in significantly less time than with brute-force attacks.
By gaining access to private keys, attackers may gain access to potentially sensitive information, perform man-in-the-middle attacks, or bypass security restrictions that depend on the security properties of the affected keys. Other attacks may also be possible.
Exploit / POC
nCipher Testing Options Insecure Key Generation Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
nCipher Testing Options Insecure Key Generation Vulnerabilities
Solution:
The vendor has released an advisory, along with fixes to address these issues. Please see the referenced advisory for further information.
Solution:
The vendor has released an advisory, along with fixes to address these issues. Please see the referenced advisory for further information.
References
nCipher Testing Options Insecure Key Generation Vulnerabilities
References:
References: