Description
The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.
References
- 20060308 nCipher Advisory #13: CBC-MAC IV misleading programming interface mailing-list
- ADV-2006-0862 vdb-entry
- ncipher-ncore-bypass-security(25062) vdb-entry
- 17011 vdb-entry
- http://www.ncipher.com/resources/96/sa13_cbcmac_iv_misleading_programming_interface
- 1015718 vdb-entry
- 19137 third-party-advisory