Executive Summary
Summary | |
---|---|
Title | NCR SelfServ ATM BNA contains multiple vulnerabilities |
Informations | |||
---|---|---|---|
Name | VU#815655 | First vendor Publication | 2020-08-21 |
Vendor | VU-CERT | Last vendor Modification | 2020-08-21 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | |||
---|---|---|---|
Overall CVSS Score | 7.6 | ||
Base Score | 7.6 | Environmental Score | 7.6 |
impact SubScore | 6 | Temporal Score | 7.6 |
Exploitabality Sub Score | 0.9 | ||
Attack Vector | Physical | Attack Complexity | Low |
Privileges Required | None | User Interaction | None |
Scope | Changed | Confidentiality Impact | High |
Integrity Impact | High | Availability Impact | High |
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.6 | Attack Range | Local |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
OverviewNCR SelfServ automated teller machines (ATMs) running APTRA XFS 04.02.01 and 05.01.00 are vulnerable to physical attacks on the communications bus between the host computer and the bunch note accepter (BNA). DescriptionNCR ATM SelfServ devices running APTRA XFS 04.02.01 and 05.01.00 contain vulnerabilities that can be exploited by an attacker with physical access to the internal components of the ATM, specifically the BNA and the host computer. CVE-2020-10124NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer. A similar vulnerability is identified as CVE-2020-9062 in VU#221785. CVE-2020-9062 involves the cash and check deposit module (CCDM) in ATMs from a different vendor. The CCDM is functionally similar to the BNA. CVE-2020-10125NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate BNA software updates. Keys of this strength can be broken by an attacker in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code. (CWE-326) CVE-2020-10126NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate software updates for the BNA. An attacker with physical access to internal ATM components can restart the host computer. During boot, the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive. This allows an attacker to execute arbitrary code with SYSTEM privileges. (CWE-305) ImpactAn attacker with physical access to the internal components of the ATM, including the BNA, can execute arbitrary code. An attacker may also be able to commit deposit forgery, with or without also executing arbitrary code. A deposit forgery attack requires two separate transactions. The attacker must first deposit actual currency and manipulate the message from the BNA to the host computer to indicate a greater amount or value than was actually deposited. Then the attacker must make a withdrawal for an artificially increased amount or value of currency. This second transaction may need to occur at an ATM operated by a different financial institution (i.e., a not-on-us or OFF-US transaction). SolutionApply an updateUpdate software to APTRA XFS 06.08. The update increases the strength of the RSA keys to limit the window of opportunity for an attacker to crack and misuse the keys (CVE-2020-10125). The update also provides protection against the bypass of the digital signature check (CVE-2020-10126). AcknowledgementsThese vulnerabilities were researched and reported by Roman Bazhin and Dmitry Turchenkov. At the time of the initial report, Roman Bazhin and Dmitry Turchenkov were associated with Embedi. Coordinating with Embedi was supported by U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) License No. CYBER2-2019-359003-1, Cyber-Related Sanctions Regulations License issued April 2, 2019 to Licensees: CERT Coordination Center at Carnegie Mellon?s Software Engineering Institute (CERT), U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency (CISA), the National Cybersecurity and Communications Integration Center. This document was written by Eric Hatleback and Laurie Tyzenhaus. |
Original Source
Url : https://kb.cert.org/vuls/id/815655 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
20 % | CWE-347 | Improper Verification of Cryptographic Signature |
20 % | CWE-326 | Inadequate Encryption Strength |
20 % | CWE-319 | Cleartext Transmission of Sensitive Information |
20 % | CWE-311 | Missing Encryption of Sensitive Data (CWE/SANS Top 25) |
20 % | CWE-306 | Missing Authentication for Critical Function (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 | |
Os | 2 |
Alert History
Date | Informations |
---|---|
2020-09-02 21:29:04 |
|
2020-09-02 17:29:06 |
|
2020-09-02 17:17:37 |
|