CVE Feed

    Dashboard / CVE / CVE-2019-15809

    CVE-2019-15809

    Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because the Atmel Toolbox 00.03.11.05 contains two versions of ECDSA signature functions, described as fast and secure, but the affected cards chose to use the fast version, which leaks the bit length of the random nonce via timing. This affects Athena IDProtect 010b.0352.0005, Athena IDProtect 010e.1245.0002, Athena IDProtect 0106.0130.0401, Athena IDProtect 010e.1245.0002, Valid S/A IDflex V 010b.0352.0005, SafeNet eToken 4300 010e.1245.0002, TecSec Armored Card 010e.0264.0001, and TecSec Armored Card 108.0264.0001.

    Published:Oct 3, 2019
    Last Modified:Nov 21, 2024
    EPS:Oct 3, 2019
    EPSS Score:0.00105
    CVSS Score:4.7

    Affected Products

    Vendor
    Athena-scs
    Product
    Idprotect
    Vendor
    Cryptsoft
    Product
    S\/a Idflex V
    Vendor
    Microchip
    Product
    Atmel Toolbox
    Vendor
    Tecsec
    Product
    Armored Card
    Vendor
    Thalesgroup
    Product
    Etoken 4300

    Exploits

    https://minerva.crocs.fi.muni.cz/https://minerva.crocs.fi.muni.cz/

    Common Weakness Enumeration

    CWE-203 Observable Discrepancy

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-189 Black Box Reverse Engineering

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High