Multiple Vendor ATM Hardware Security Module PIN Generation/Verification Vulnerability
BID:6901
Info
Multiple Vendor ATM Hardware Security Module PIN Generation/Verification Vulnerability
| Bugtraq ID: | 6901 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 20 2003 12:00AM |
| Updated: | Feb 20 2003 12:00AM |
| Credit: | Discovery is credited to Mike Bond and Piotr Zielinski. |
| Vulnerable: |
IBM Common Cryptographic Architecture 2.41 IBM Common Cryptographic Architecture 2.40 IBM CMOS Cryptographic Coprocessor IBM 4758 |
| Not Vulnerable: | |
Discussion
Multiple Vendor ATM Hardware Security Module PIN Generation/Verification Vulnerability
A paper has been released detailing design flaws in the APIs used by various ATM Hardware Security Modules (HSM) to protect customer PIN numbers. Various potential attacks exist on methods used to generate and verify PIN numbers which may significantly reduce the difficulty of brute force attempts.
A paper has been released detailing design flaws in the APIs used by various ATM Hardware Security Modules (HSM) to protect customer PIN numbers. Various potential attacks exist on methods used to generate and verify PIN numbers which may significantly reduce the difficulty of brute force attempts.
Solution / Fix
Multiple Vendor ATM Hardware Security Module PIN Generation/Verification Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.