PT-2019-15571 · Shapeshift · Keepkey

Christian Reitter · Publicado 2019-12-06 · Atualizado 2024-03-08 · CVE-2019-18672

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ShapeShift KeepKey hardware wallet versions prior to 6.2.2

Description The issue is related to insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet. This allows a partial reset of cryptographic secrets to known values via crafted messages, which can be sent by unauthenticated attackers through the WebUSB interface. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations.

Recommendations For versions prior to 6.2.2, update the firmware to version 6.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebUSB interface to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-354

Identificadores relacionados

CVE-2019-18672

Produtos afetados

Keepkey

Referências · 7

• https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680 · Correção
• https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-18672 · Nota de Segurança
• https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 · Nota
• https://twitter.com/Esparta6108713/status/1766337426027331933 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2019-18672 · Aviso do Fabricante
• https://blog.inhq.net/posts/keepkey-CVE-2019-18672 · Nota