PT-2019-9871 · Utimaco · Utimaco Cryptoserver Hsm

Published 2019-04-09 · Updated 2019-10-03 · CVE-2018-19589

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Utimaco CryptoServer HSM (affected versions not specified)

Description The issue concerns incorrect access controls in the PKCS11 R2 provider of the Utimaco CryptoServer HSM product package. This allows a Security Officer (SO) authenticated to a slot to retrieve attributes of and delete private keys in external key storage. The confidentiality and integrity of the affected keys remain unaffected, but their availability is compromised. This could lead to a "reverse ransomware" attack, where an attacker denies legitimate users access to keys while maintaining possession of an encrypted copy of the external key store for ransom. The attack can be executed via a physical connection to the CryptoServer or remotely if SSH or LAN access has been compromised.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-19589

Affected Products

Utimaco Cryptoserver Hsm

References · 4

• 🔥 https://linkedin.com/pulse/does-hsm-guarantee-cryptographic-key-security-kwadjo-nyante · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19589 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19589 · Vendor Advisory
• https://support.hsm.utimaco.com/support/security-advisories/-/blogs/cve-2018-19589 · Vendor Advisory