FKIE_CVE-2019-18672

Vulnerability from fkie_nvd - Published: 2019-12-06 18:15 - Updated: 2024-11-21 04:33
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB.
References
cve@mitre.orghttps://blog.inhq.net/posts/keepkey-CVE-2019-18672/
cve@mitre.orghttps://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680Patch, Third Party Advisory
cve@mitre.orghttps://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065Third Party Advisory
cve@mitre.orghttps://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.inhq.net/posts/keepkey-CVE-2019-18672/
af854a3a-2127-422b-91ae-364da2661108https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3Third Party Advisory
Impacted products
Vendor Product Version
shapeshift keepkey_firmware *
shapeshift keepkey_firmware -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:shapeshift:keepkey_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2E31C0B-7A1C-463C-B8ED-942F7C7BC9E3",
              "versionEndExcluding": "6.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:shapeshift:keepkey_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C96080B0-34F6-45C3-B3A1-6B029B62A118",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB."
    },
    {
      "lang": "es",
      "value": "Las comprobaciones insuficientes en la m\u00e1quina de estados finitos de la billetera de hardware ShapeShift KeepKey versiones de firmware anteriores a 6.2.2, permiten un restablecimiento parcial de los secretos criptogr\u00e1ficos a valores conocidos por medio de mensajes dise\u00f1ados. En particular, esto rompe la seguridad de U2F para nuevos registros del servidor e invalida los registros existentes. Esta vulnerabilidad puede ser explotada por atacantes no autenticados y la interfaz es accesible por medio de WebUSB."
    }
  ],
  "id": "CVE-2019-18672",
  "lastModified": "2024-11-21T04:33:30.100",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-12-06T18:15:12.700",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.