yubikey-personalization Insecure AES Key Generation Security Bypass Weakness

Bugtraq ID:	45969
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 10 2010 12:00AM
Updated:	Sep 10 2010 12:00AM
Credit:	Ben
Vulnerable:	yubikey-personalization yubikey-personalization 1.3.3
Not Vulnerable:	yubikey-personalization yubikey-personalization 1.3.4

yubikey-personalization Insecure AES Key Generation Security Bypass Weakness

yubikey-personalization is prone to a security-bypass weakness.

An attacker may be able to exploit this issue to aid in brute-force attacks; other attacks may also be possible.

yubikey-personalization Insecure AES Key Generation Security Bypass Weakness

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

yubikey-personalization Insecure AES Key Generation Security Bypass Weakness

Solution:
Updates are available. Please see the references for more information.

yubikey-personalization Insecure AES Key Generation Security Bypass Weakness

References:

• Revision: r259 (simon75j )
  
• yubikey-personalization (yubikey-personalization)