CVE-2004-0063 The SPP_VerifyPVV function in nCipher payShield SPP library 1.3.12, 1.5.18 and 1.6.18 returns a Status_OK value even if the HSM returns a different status code, which could cause applications to make....
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SPP_VerifyPVV function in nCipher payShield SPP library 1.3.12, 1.5.18 and 1.6.18 returns a Status_OK value even if the HSM returns a different status code, which could cause applications to make incorrect security-critical decisions, e.g. by accepting an invalid PIN number.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ncipher payshield spp library | = 1.3.12 | No fix listed |
| ncipher payshield spp library | = 1.5.18 | No fix listed |
| ncipher payshield spp library | = 1.6.18 | No fix listed |
References
- 20040114 nCipher Advisory #8: payShield library may verify bad requests mailing-list
- www.ncipher.com vendor-advisory
- 3537 vdb-entry
- 9422 vdb-entry
- payshield-incorrect-request-verification(14832) vdb-entry