CVE-2016-6257

Опубликовано: 02 авг. 2016

Источник: nvd

CVSS3: 6.5

CVSS2: 3.3

EPSS Низкий

Описание

The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack."

Ссылки

http://www.securityfocus.com/bid/92179
Third Party Advisory
VDB Entry
https://github.com/BastilleResearch/keyjack/blob/master/doc/advisories/bastille-13.lenovo-ultraslim.public.txt
Third Party Advisory
https://support.lenovo.com/product_security/len_7267
Vendor Advisory
https://www.bastille.net/research/vulnerabilities/keyjack
Third Party Advisory
http://www.securityfocus.com/bid/92179
Third Party Advisory
VDB Entry
https://github.com/BastilleResearch/keyjack/blob/master/doc/advisories/bastille-13.lenovo-ultraslim.public.txt
Third Party Advisory
https://support.lenovo.com/product_security/len_7267
Vendor Advisory
https://www.bastille.net/research/vulnerabilities/keyjack
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:amazonbasics:firmware:-:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:amazonbasics:usb_dongle:-:*:*:*:*:*:*:*

cpe:2.3:h:amazonbasics:wireless_keyboard:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:dell:km714_firmware:*:*:*:*:*:*:*:*

Версия до 012.005.00028 (включая)

Одно из

cpe:2.3:h:dell:km714_dongle:-:*:*:*:*:*:*:*

cpe:2.3:h:dell:km714_wireless_keyboard:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:dell:km632_firmware:-:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:dell:km632_dongle:-:*:*:*:*:*:*:*

cpe:2.3:h:dell:km632_wireless_keyboard:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

Одно из

cpe:2.3:o:logitech:unifying_firmware:*:*:*:*:*:*:*:*

Версия до 012.005.00028 (включая)

cpe:2.3:o:logitech:unifying_firmware:*:*:*:*:*:*:*:*

Версия до 024.003.00027 (включая)

cpe:2.3:h:logitech:unifying_dongle:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:lenovo:ultraslim_firmware:-:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:lenovo:ultraslim_dongle:-:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:ultraslim_wireless_keyboard:-:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01034

Низкий

6.5 Medium

CVSS3

3.3 Low

CVSS2

Дефекты

CWE-310

Связанные уязвимости

GHSA-mjv4-gqjq-h75g

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 77%

0.01034

Низкий

6.5 Medium

CVSS3

3.3 Low

CVSS2

Дефекты

CWE-310