CVE-2002-1446 The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later returns the CKR_OK status even when it detects an invalid signature...
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later returns the CKR_OK status even when it detects an invalid signature, which could allow remote attackers to modify or forge messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ncipher pkcs 11 library | = 1.2.0 | No fix listed |
References
- 20020819 nCipher Advisory #5: C_Verify validates incorrect symmetric signatures mailing-list
- ncipher-cverify-improper-verification(9895) vdb-entry
- www.ncipher.com patch
- 5498 vdb-entry