Vulnerability Details CVE-2002-1446
The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later returns the CKR_OK status even when it detects an invalid signature, which could allow remote attackers to modify or forge messages.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 59.4%
CVSS Severity
CVSS v2 Score 5.0
References
- http://archives.neohapsis.com/archives/bugtraq/2002-08/0172.html
- http://www.iss.net/security_center/static/9895.php
- http://www.ncipher.com/support/advisories/advisory5_c_verify.html
- http://www.securityfocus.com/bid/5498
- http://archives.neohapsis.com/archives/bugtraq/2002-08/0172.html
- http://www.iss.net/security_center/static/9895.php
- http://www.ncipher.com/support/advisories/advisory5_c_verify.html
- http://www.securityfocus.com/bid/5498
Products affected by CVE-2002-1446
-
cpe:2.3:a:ncipher:pkcs_11_library:1.2.0