CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 1CVE-2020-26155
https://notcve.org/view.php?id=CVE-2020-26155
Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for binaries to be manipulated by non-administrator users. Additionally, entries are made to the PATH environment variable which, in conjunction with these weak permissions, could enable an attacker to perform a DLL hijacking attack. Múltiples archivos y carpetas en Utimaco SecurityServer versiones 4.20.0.4 y 4.31.1.0, son instalados con permisos de lectura y escritura para usuarios autenticados, permitiendo a usuarios no administradores manipular binarios. Adicionalmente, las entradas son realizadas en la variable de entorno PATH que, junto con estos permisos débiles, podrían permitir a un atacante llevar a cabo un ataque de secuestro DLL • https://hsm.utimaco.com/products-hardware-security-modules/general-purpose-hsm https://secureyourit.co.uk/wp/2021/03/13/utimaco-cve-2020-26155 • CWE-427: Uncontrolled Search Path Element CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-19589
https://notcve.org/view.php?id=CVE-2018-19589
Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in external key storage. This compromises the availability of all keys configured with external key storage and may result in an economic attack in which the attacker denies legitimate users access to keys while maintaining possession of an encrypted copy (blob) of the external key store for ransom. This attack has been dubbed reverse ransomware attack and may be executed via a physical connection to the CryptoServer or remote connection if SSH or remote access to LAN CryptoServer has been compromised. The Confidentiality and Integrity of the affected keys, however, remain untarnished. Los Controles de Acceso incorrectos del Security Officer (SO) en el proveedor PKCS11 R2 que se envía con el paquete del producto Utimaco CryptoServer HSM permite que un SO identificado en un espacio recupere los atributos de las claves marcadas como claves privadas en el almacenamiento de las claves externas, y también elimine las claves marcadas como claves privadas en el almacenamiento de las claves externas. • https://support.hsm.utimaco.com/support/security-advisories/-/blogs/cve-2018-19589 https://www.linkedin.com/pulse/does-hsm-guarantee-cryptographic-key-security-kwadjo-nyante • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-7142
https://notcve.org/view.php?id=CVE-2006-7142
The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which allows attackers to recover the keys from the configuration files and decrypt the disk drive. La utilidad "gestión centralizada" para Utimaco Safeguard almacena claves criptográficas directamente en el código, en programas ejecutables para ficheros de configuración cifrados, lo cual permite a atacantes remotos recuperar claves de los ficheros de configuración y descifrar la unidad de disco. • http://www.securityfocus.com/archive/1/448598/100/0/threaded http://www.securityfocus.com/archive/1/449120/100/0/threaded http://www.securityfocus.com/bid/20529 http://www.utimaco.fi/servlets/ActionDispatcher?action:ws3_content_get_binary=true&scope=domain&domain_id=www.utimaco.fi&page_id=/templates/ajankohtaisteksti.jsp?ws3_page_id=tiedoteartikkeli_103&form_id=&component_id=linkin_dokumentti_104 • CWE-798: Use of Hard-coded Credentials •