← Back

CVE-2019-15809

nvd nist
Published: Oct 3, 2019Modified: Jun 17, 2026

JSON object

Loading...
4.7
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.0 / Impact: 3.6
Source: NVD

Description

Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because the Atmel Toolbox 00.03.11.05 contains two versions of ECDSA signature functions, described as fast and secure, but the affected cards chose to use the fast version, which leaks the bit length of the random nonce via timing. This affects Athena IDProtect 010b.0352.0005, Athena IDProtect 010e.1245.0002, Athena IDProtect 0106.0130.0401, Athena IDProtect 010e.1245.0002, Valid S/A IDflex V 010b.0352.0005, SafeNet eToken 4300 010e.1245.0002, TecSec Armored Card 010e.0264.0001, and TecSec Armored Card 108.0264.0001.

Affected (8)

Show all products
Microchip: Atmel Toolbox · Athena Scs: Idprotect · Cryptsoft: S/a Idflex V · Tecsec: Armored Card · Thalesgroup: Etoken 4300
Microchip
1 product
Atmel Toolbox
Athena Scs
1 product
Idprotect
Cryptsoft
1 product
S/a Idflex V
Tecsec
1 product
Armored Card
Thalesgroup
1 product
Etoken 4300
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Atmel Toolbox
Version 00.03.11.05
Configuration B
7 vulnerable
Vulnerable SoftwareAffected Versions
Athena Scs
Idprotect
Version 0106.0130.0401
Idprotect
Version 010b.0352.0005
Idprotect
Version 010e.1245.0002
S/a Idflex V
Version 010b.0352.0005
Tecsec
Armored Card
Version 010e.0264.0001
Armored Card
Version 108.0264.0001
Etoken 4300
Version 010e.1245.0002

Related CWEs

CWE-203
Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (12)

Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party AdvisoryUS Government Resource
Source: cve@mitre.org
Technical DescriptionThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Technical DescriptionThird Party Advisory
Source: cve@mitre.org
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Technical DescriptionThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Technical DescriptionThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Product

Timeline

No history available yet.