PT-2004-1274 · Ncipher · Ncipher Payshield Spp Library

Publicado 2004-02-17 · Atualizado 2017-10-10 · CVE-2004-0063

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ncipher payShield SPP library versions 1.3.12, 1.5.18, 1.6.18

Description The issue concerns the SPP VerifyPVV function in the nCipher payShield SPP library, which may return a Status OK value even when the HSM returns a different status code. This could lead to applications making incorrect security-critical decisions, such as accepting an invalid PIN number.

Recommendations For version 1.3.12, consider disabling the SPP VerifyPVV function until a patch is available. For version 1.5.18, restrict the use of the SPP VerifyPVV function to minimize the risk of exploitation. For version 1.6.18, avoid relying on the Status OK value returned by the SPP VerifyPVV function for security-critical decisions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-0063

Produtos afetados

Ncipher Payshield Spp Library

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/14832 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0063 · Nota de Segurança
• http://securityfocus.com/bid/9422 · Nota
• http://ncipher.com/support/advisories/advisory8_payshield.html · Aviso do Fabricante
• http://osvdb.org/3537 · Nota
• http://marc.info/?l=bugtraq&m=107411819503569&w=2 · Nota