PT-2019-15570 · Shapeshift · Keepkey

Christian Reitter · Publicado 2019-12-06 · Atualizado 2020-02-12 · CVE-2019-18671

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ShapeShift KeepKey hardware wallet versions prior to 6.2.2

Description The issue is related to insufficient checks in the USB packet handling, allowing out-of-bounds writes in the .bss segment via crafted messages. This could potentially allow code execution or other forms of impact. The vulnerability can be triggered by unauthenticated attackers and is reachable via WebUSB.

Recommendations For versions prior to 6.2.2, update the firmware to version 6.2.2 or later to resolve the issue. As a temporary workaround, consider restricting WebUSB access to the ShapeShift KeepKey hardware wallet until the firmware update is applied.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-18671

Produtos afetados

Keepkey

Referências · 6

• https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3 · Correção
• https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 · Nota
• https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 · Nota
• https://blog.inhq.net/posts/keepkey-CVE-2019-18671 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-18671 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18671 · Aviso do Fabricante