PT-2019-9871 · Utimaco · Utimaco Cryptoserver Hsm

Publicado 2019-04-09 · Atualizado 2019-10-03 · CVE-2018-19589

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Utimaco CryptoServer HSM (affected versions not specified)

Description The issue concerns incorrect access controls in the PKCS11 R2 provider of the Utimaco CryptoServer HSM product package. This allows a Security Officer (SO) authenticated to a slot to retrieve attributes of and delete private keys in external key storage. The confidentiality and integrity of the affected keys remain unaffected, but their availability is compromised. This could lead to a "reverse ransomware" attack, where an attacker denies legitimate users access to keys while maintaining possession of an encrypted copy of the external key store for ransom. The attack can be executed via a physical connection to the CryptoServer or remotely if SSH or LAN access has been compromised.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-19589

Produtos afetados

Utimaco Cryptoserver Hsm

Referências · 4

• 🔥 https://linkedin.com/pulse/does-hsm-guarantee-cryptographic-key-security-kwadjo-nyante · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19589 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19589 · Aviso do Fabricante
• https://support.hsm.utimaco.com/support/security-advisories/-/blogs/cve-2018-19589 · Aviso do Fabricante