PT-2002-1948 · Ncipher · Ncipher Mscapi Csp

Published 2002-08-31 · Updated 2008-09-10 · CVE-2002-0939

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: nCipher MSCAPI CSP version 5.50

Description: The issue concerns the Install Wizard for nCipher MSCAPI CSP, which fails to utilize Operator Card Set protected keys as requested by the user when the Operator Card Set is not generated. This results in a lower protection level than what the user specified, providing only module protection.

Recommendations: For version 5.50, ensure that the Operator Card Set is properly generated when requesting protected keys to maintain the desired protection level. As a temporary workaround, consider manually verifying the protection level after installation to ensure it meets the user's requirements.

Fix

Related Identifiers

CVE-2002-0939

Affected Products

Ncipher Mscapi Csp

References · 4

• http://iss.net/security_center/static/9076.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0939 · Security Note
• http://securityfocus.com/bid/4729 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-05/0103.html · Note