nCipher测试选项不安全密钥生成漏洞

CVE编号

CVE-2006-1117

利用情况

暂无

补丁情况

N/A

披露时间

2006-03-10

漏洞描述

nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not production, which might allow remote attackers to obtain information about encryption keys and crack those keys with less effort than brute force.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://secunia.com/advisories/19137
http://securitytracker.com/id?1015718
http://www.ncipher.com/resources/97/sa14_presence_of_flaws_in_firmware_security
http://www.securityfocus.com/archive/1/427151/100/0/threaded
http://www.securityfocus.com/bid/17012
http://www.vupen.com/english/advisories/2006/0862
https://exchange.xforce.ibmcloud.com/vulnerabilities/25063

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	ncipher	dse200_document_sealing_engine	*	-
	运行在以下环境
	应用	ncipher	ncore	*	-
	运行在以下环境
	应用	ncipher	nforce	*	-
	运行在以下环境
	应用	ncipher	securedb	*	-
	运行在以下环境
	应用	ncipher	time_source_master_clock	*	-

CVSS3评分 2.6

• 攻击路径 网络
• 攻击复杂度 高
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 无
• 保密性 部分地
• 完整性 无

AV:N/AC:H/Au:N/C:P/I:N/A:N

CWE-ID	漏洞类型
NVD-CWE-Other

Exp相关链接

- avd.aliyun.com