CVE-2006-7142

The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which allows attackers to recover the keys from the configuration files and decrypt the disk drive.

CVSS v3 7.8 HIGH
CVSS v2.0 4.1 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 2.7 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/archive/1/448598/100/0/threaded	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/449120/100/0/threaded	Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/20529	Broken Link Third Party Advisory VDB Entry
http://www.utimaco.fi/servlets/ActionDispatcher?action:ws3_content_get_binary=true&scope=domain&domain_id=www.utimaco.fi&page_id=/templates/ajankohtaisteksti.jsp?ws3_page_id=tiedoteartikkeli_103&form_id=&component_id=linkin_dokumentti_104	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:utimaco:safeguard:4.30:*:*:*:*:*:*:*

History

13 Feb 2024, 16:45

Type	Values Removed	Values Added
CVSS	v2 : ~~4.1~~ v3 : ~~unknown~~	v2 : 4.1 v3 : 7.8
CPE	cpe:2.3:a:utimaco_safeware:safeguard_easy:4.30:::::::*	cpe:2.3:a:utimaco:safeguard:4.30:::::::*
First Time		Utimaco safeguard Utimaco

Information

Published : 2007-03-07 20:19

Updated : 2024-02-28 11:01

NVD link : CVE-2006-7142

Mitre link : CVE-2006-7142

CVE.ORG link : CVE-2006-7142

JSON object : View

Products Affected

utimaco

safeguard

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2006-7142", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 2.7, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2007-03-07T20:19:00.000", "references": [{"url": "http://www.securityfocus.com/archive/1/448598/100/0/threaded", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/449120/100/0/threaded", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/20529", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.utimaco.fi/servlets/ActionDispatcher?action:ws3_content_get_binary=true&scope=domain&domain_id=www.utimaco.fi&page_id=/templates/ajankohtaisteksti.jsp?ws3_page_id=tiedoteartikkeli_103&form_id=&component_id=linkin_dokumentti_104", "tags": ["Broken Link"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which allows attackers to recover the keys from the configuration files and decrypt the disk drive."}, {"lang": "es", "value": "La utilidad \"gesti\u00f3n centralizada\" para Utimaco Safeguard almacena claves criptogr\u00e1ficas directamente en el c\u00f3digo, en programas ejecutables para ficheros de configuraci\u00f3n cifrados, lo cual permite a atacantes remotos recuperar claves de los ficheros de configuraci\u00f3n y descifrar la unidad de disco."}], "lastModified": "2024-02-13T16:45:26.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:utimaco:safeguard:4.30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DA59D49-45CE-4775-AB77-B69EBEFCC8F5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}