PT-2004-1274 · Ncipher · Ncipher Payshield Spp Library

Published 2004-02-17 · Updated 2017-10-10 · CVE-2004-0063

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ncipher payShield SPP library versions 1.3.12, 1.5.18, 1.6.18

Description The issue concerns the SPP VerifyPVV function in the nCipher payShield SPP library, which may return a Status OK value even when the HSM returns a different status code. This could lead to applications making incorrect security-critical decisions, such as accepting an invalid PIN number.

Recommendations For version 1.3.12, consider disabling the SPP VerifyPVV function until a patch is available. For version 1.5.18, restrict the use of the SPP VerifyPVV function to minimize the risk of exploitation. For version 1.6.18, avoid relying on the Status OK value returned by the SPP VerifyPVV function for security-critical decisions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0063

Affected Products

Ncipher Payshield Spp Library

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-0063 · Security Note
• http://ncipher.com/support/advisories/advisory8_payshield.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14832 · Note
• http://securityfocus.com/bid/9422 · Note
• http://osvdb.org/3537 · Note
• http://marc.info/?l=bugtraq&m=107411819503569&w=2 · Note