PT-2003-2362 · Ncipher · Ncipher Support

Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1417

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nCipher Support Software version 6.00

Description The issue concerns the generatekey KeySafe feature in nCipher Support Software, which fails to delete temporary key copies after import. This oversight may allow local users to access the key by reading the key.pem or key.der files.

Recommendations For nCipher Support Software version 6.00, consider manually deleting the temporary key.pem and key.der files after key import to prevent unauthorized access. As a temporary workaround, restrict access to these files to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2003-1417

Produtos afetados

Ncipher Support

Referências · 5

• http://marc.info/?l=bugtraq&m=104619088801750&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1417 · Nota de Segurança
• http://securityfocus.com/bid/6927 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11422 · Nota
• http://ncipher.com/support/advisories/advisory7_keyduplicates.html · Nota