PT-2003-2362 · Ncipher · Ncipher Support

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1417

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nCipher Support Software version 6.00

Description The issue concerns the generatekey KeySafe feature in nCipher Support Software, which fails to delete temporary key copies after import. This oversight may allow local users to access the key by reading the key.pem or key.der files.

Recommendations For nCipher Support Software version 6.00, consider manually deleting the temporary key.pem and key.der files after key import to prevent unauthorized access. As a temporary workaround, restrict access to these files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2003-1417

Affected Products

Ncipher Support

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-1417 · Security Note
• http://marc.info/?l=bugtraq&m=104619088801750&w=2 · Note
• http://securityfocus.com/bid/6927 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11422 · Note
• http://ncipher.com/support/advisories/advisory7_keyduplicates.html · Note