PT-2018-5468 · Ieee · Ieee P1735

Animesh Chhotaray + 1 · Published 2018-07-13 · Updated 2019-10-09 · CVE-2017-13091

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: IEEE P1735 (affected versions not specified)

Description: The P1735 IEEE standard has flawed methods for encrypting electronic-design intellectual property (IP) and managing access rights. Specifically, the improperly specified padding in CBC mode can be exploited, allowing the use of an EDA tool as a decryption oracle. This flaw enables attack vectors that can recover the entire underlying plaintext IP. Implementations of this standard may be weak to cryptographic attacks, potentially allowing attackers to obtain plaintext intellectual property without the key.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2017-13091

Affected Products

Ieee P1735

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-13091 · Security Note
• http://securityfocus.com/bid/101699 · Note
• https://kb.cert.org/vuls/id/739007 · Note