CVE-2019-18672

Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB.

CVSS v3.0 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3	Third Party Advisory
https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065	Third Party Advisory
https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680	Patch Third Party Advisory
https://blog.inhq.net/posts/keepkey-CVE-2019-18672/

Advertisement

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:shapeshift:keepkey_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:shapeshift:keepkey_firmware:-:*:*:*:*:*:*:*

Information

Published : 2019-12-06 10:15

Updated : 2020-03-02 07:15

NVD link : CVE-2019-18672

Mitre link : CVE-2019-18672

JSON object : View

CWE

CWE-354

Improper Validation of Integrity Check Value

Advertisement

Products Affected

shapeshift

keepkey_firmware

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3", "name": "https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065", "name": "https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680", "name": "https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/", "name": "https://blog.inhq.net/posts/keepkey-CVE-2019-18672/", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-354"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-18672", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2019-12-06T18:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:shapeshift:keepkey_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.2.2"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:shapeshift:keepkey_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-03-02T15:15Z"}