[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ce2131c4-be44-4426-d290-b3811657a5f7@x41-dsec.de>
Date: Tue, 14 Aug 2018 15:37:20 +0200
From: X41 D-Sec GmbH Advisories <advisories@...-dsec.de>
To: oss-security@...ts.openwall.com
Subject: X41 D-Sec GmbH Security Advisory X41-2018-001: Multiple
Vulnerabilities in Yubico Piv
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
X41 D-Sec GmbH Security Advisory: X41-2018-001
Multiple Vulnerabilities in Yubico Piv
======================================
Overview
- --------
Confirmed Affected Versions: 1.5.0
Confirmed Patched Versions: 1.6.0
Vendor: Yubico
Vendor URL: https://www.yubico.com/
Vendor Advisory URL: https://www.yubico.com/support/security-advisories
Credit: X41 D-Sec GmbH, Eric Sesterhenn
Status: Public
Advisory-URL:
https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/
Summary and Impact
- ------------------
A buffer overflow and an out of bounds memory read were identified in
the yubico-piv-tool-1.5.0, these can be triggered by a malicious token.
X41 did not perform a full test or audit on the software.
Product Description
- -------------------
YubiKey 4, YubiKey 4 Nano, YubiKey 4C, YubiKey 4C Nano, and YubiKey
NEO provide Smart Card functionality based on the Personal Identity
Verification (PIV) interface specified in NIST SP 800-73,
“Cryptographic Algorithms and Key Sizes for PIV.”
Out of Bounds Write via Malicious APDU
======================================
Severity Rating: High
Vector: APDU Response
CVE: CVE-2018-14779
CWE: 120
CVSS Score: 7.1 (High)
CVSS Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary and Impact
- ------------------
File lib/ykpiv.c contains the following code in function
ykpiv_transfer_data()
{% highlight c %}
if(*outlen + recvlen - 2 > maxout) {
fprintf(stderr, "Output buffer to small, wanted to write %lu,
max was %lu.", *outlen + recvlen - 2, maxout);
}
if(outdata) {
memcpy(outdata, data, recvlen - 2);
outdata += recvlen - 2;
*outlen += recv_len - 2;
}
{% endhighlight %}
It is clearly checked whether the buffer is big enough to hold the
data copied using memcpy(), but no error handling happens to avoid the
memcpy() in such cases. This code path can be triggered with malicious
data coming from a smartcard.
Workarounds
- -----------
None
Out of Bounds Read via malicious APDU
=====================================
Severity Rating: LOW
Vector: APDU Response
CVE: CVE-2018-14780
CWE: 125
CVSS Score: 2.2 (Low)
CVSS Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Summary and Impact
- ------------------
File lib/ykpiv.c contains the following code in function
_ykpiv_fetch_object()
{% highlight c %}
if(sw == SWSUCCESS) {
sizet outlen;
int offs = ykpivgetlength(data + 1, &outlen);
if(offs == 0) {
return YKPIVSIZEERROR;
}
memmove(data, data + 1 + offs, outlen);
*len = outlen;
return YKPIVOK;
} else {
return YKPIVGENERICERROR;
}
{% endhighlight %}
In the end, a memmove() occurs with a length retrieved from APDU data.
This length is not checked if it is outside of the APDU data
retrieved. Therefore the memmove() could copy bytes behind the
allocated data buffer into this buffer.
Workarounds
- -----------
None
Timeline
========
2018-02-03 Issues found
2018-05-22 Vendor contacted
2018-05-22 Vendor reply
2018-06-05 Requesting technical feedback from the vendor
2018-06-06 Vendor confirms bug
2018-08-01 CVE ID requested
2018-08-02 CVE ID assigned
2018-08-08 Patched version released by vendor
2018-08-11 Advisory released
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEpwxVTgxAIcUvTugIo5Klpg50CxAFAlty2wYACgkQo5Klpg50
CxBY3Q//Y4ux5/9kpM3ZCGXU7hpjC0nTOKNJY/W4dIKtA14OCc+hLf1tPhOCB170
oimZRyXD6HR4OPGnbpgKAoLbWFBAt6fjwYweKGb2I1qnLsGLt/t9ussY5ElbFHqQ
FGzbQcgp1DcwCI3EWj+AjwQPBzjNvGTqgizq3rbc6coKsbnzeXR1UUWjQb7PFgAW
+O6S74dIaP+J/OwMPye/JkAkAAPiPGfpFp5xFC60d2KZIAdSiK6xg+Ip8i9gYLnQ
6WCagyQe2X8YmeFSvSvx3pAAiUMW8bdgt39j2EuKZLRScyotH6/1ixjC2gm8WY0u
6vlSmFVP/HyRB0u4JKMgY3KkS0CCZhhpPMjK38CctsPN+jt6KcPf2+TEkQK/m6ts
IeU8+XSWGigNFALCJJoIPplXi+/XCs+qzNmq2pRvrNt2rd/7cu3+AxnivxX/9ZUt
pei7+530GWumFXvgBjFlL4GCSKzJDWRM3gfXZK1UPqAIiG1J+MJ2F8Pijui3maq7
/N04sTRGZaTcKT22hgZ9ePrCSOAGqPof1+UUMFjDjTCCDZ2BI9GmsQHkjvFzfKQc
8dBZzzyopo9sD/CloLA3EATH7KdhyCfDKq/oRma5ZhVWgfMGJmlAzLmJXMTiIwwH
SgU/sj8ArM37EYzpO+eqtnaJum9o5GE5p/EkwG1J3N4BeAag9mE=
=wcuQ
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
