Vulnerability-Lookup

CNVD-2018-15858

Vulnerability from cnvd - Published: 2018-08-22

Title

Microsoft Research JavaScript Cryptography Library安全绕过漏洞

Description

Microsoft Research JavaScript Cryptography Library是美国微软（Microsoft）公司的一款用于云服务的JavaScript加密库，它支持RSA加密/解密、AES-CBC加密/解密和GCM加密/解密等。 Microsoft Research JavaScript Cryptography Library中存在安全绕过漏洞，该漏洞源于不正确的算术计算。攻击者可通过构造签名（无需对应的密钥）并模仿与公钥/私钥对相关联的实体利用该漏洞绕过安全限制，执行未授权的操作。

Severity

中

Patch Name

Microsoft Research JavaScript Cryptography Library安全绕过漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319

Reference

https://nvd.nist.gov/vuln/detail/CVE-2018-8319

Impacted products

Name
Microsoft Research JavaScript Cryptography Library

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "104655"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-8319",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8319"
    }
  },
  "description": "Microsoft Research JavaScript Cryptography Library\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u4e91\u670d\u52a1\u7684JavaScript\u52a0\u5bc6\u5e93\uff0c\u5b83\u652f\u6301RSA\u52a0\u5bc6/\u89e3\u5bc6\u3001AES-CBC\u52a0\u5bc6/\u89e3\u5bc6\u548cGCM\u52a0\u5bc6/\u89e3\u5bc6\u7b49\u3002\r\n\r\nMicrosoft Research JavaScript Cryptography Library\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4e0d\u6b63\u786e\u7684\u7b97\u672f\u8ba1\u7b97\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6784\u9020\u7b7e\u540d\uff08\u65e0\u9700\u5bf9\u5e94\u7684\u5bc6\u94a5\uff09\u5e76\u6a21\u4eff\u4e0e\u516c\u94a5/\u79c1\u94a5\u5bf9\u76f8\u5173\u8054\u7684\u5b9e\u4f53\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002",
  "discovererName": "Jonathan Burns, Colin McRae, and Ryan Speers of Ionic Security",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-15858",
  "openTime": "2018-08-22",
  "patchDescription": "Microsoft Research JavaScript Cryptography Library\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u4e91\u670d\u52a1\u7684JavaScript\u52a0\u5bc6\u5e93\uff0c\u5b83\u652f\u6301RSA\u52a0\u5bc6/\u89e3\u5bc6\u3001AES-CBC\u52a0\u5bc6/\u89e3\u5bc6\u548cGCM\u52a0\u5bc6/\u89e3\u5bc6\u7b49\u3002\r\n\r\nMicrosoft Research JavaScript Cryptography Library\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4e0d\u6b63\u786e\u7684\u7b97\u672f\u8ba1\u7b97\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6784\u9020\u7b7e\u540d\uff08\u65e0\u9700\u5bf9\u5e94\u7684\u5bc6\u94a5\uff09\u5e76\u6a21\u4eff\u4e0e\u516c\u94a5/\u79c1\u94a5\u5bf9\u76f8\u5173\u8054\u7684\u5b9e\u4f53\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Research JavaScript Cryptography Library\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Microsoft Research JavaScript Cryptography Library"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-8319",
  "serverity": "\u4e2d",
  "submitTime": "2018-07-12",
  "title": "Microsoft Research JavaScript Cryptography Library\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2018-8319 (GCVE-0-2018-8319)

Vulnerability from cvelistv5 – Published: 2018-07-11 00:00 – Updated: 2024-08-05 06:54

Summary

A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aka "MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability." This affects Microsoft Research JavaScript Cryptography Library.

Severity

No CVSS data available.

CWE

Security Feature Bypass

Assigner

microsoft mitre root

References

3 references

URL	Tags
http://www.securityfocus.com/bid/104655	vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1041268	vdb-entryx_refsource_SECTRACK
https://portal.msrc.microsoft.com/en-US/security-…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Microsoft	Microsoft Research JavaScript Cryptography Library	Affected: Microsoft Research JavaScript Cryptography Library

Date Public

2018-07-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:54:35.225Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "104655",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104655"
          },
          {
            "name": "1041268",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041268"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft Research JavaScript Cryptography Library",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Microsoft Research JavaScript Cryptography Library"
            }
          ]
        }
      ],
      "datePublic": "2018-07-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aka \"MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability.\" This affects Microsoft Research JavaScript Cryptography Library."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Security Feature Bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-11T09:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "104655",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104655"
        },
        {
          "name": "1041268",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041268"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2018-8319",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Microsoft Research JavaScript Cryptography Library",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Microsoft Research JavaScript Cryptography Library"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aka \"MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability.\" This affects Microsoft Research JavaScript Cryptography Library."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Security Feature Bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "104655",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104655"
            },
            {
              "name": "1041268",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041268"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2018-8319",
    "datePublished": "2018-07-11T00:00:00.000Z",
    "dateReserved": "2018-03-14T00:00:00.000Z",
    "dateUpdated": "2024-08-05T06:54:35.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.