CVE-2019-15809: Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, cont
32
Routine
MEDIUM 4.7DOWNGRADEMITIGATEMITIGATE
CVE-2019-15809 is a medium-severity flaw (CVSS 4.7) affecting atmel toolbox, idprotect, s\/a idflex v. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because the Atmel Toolbox 00.03.11.05 contains two versions of ECDSA signature functions, described as fast and secure, but th
Why this priority
Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Safe to downgrade to: a release before 010b.0352.0005
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
cryptsoft s\/a idflex v MITIGATE
Affected: 010b.0352.0005
Fixed in: no fixed release known
Safe to downgrade to: a release before 010b.0352.0005
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
tecsec armored card MITIGATE
Affected: 010e.0264.0001 · 108.0264.0001
Fixed in: no fixed release known
Safe to downgrade to: a release before 010e.0264.0001
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
thalesgroup etoken 4300 MITIGATE
Affected: 010e.1245.0002
Fixed in: no fixed release known
Safe to downgrade to: a release before 010e.1245.0002
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-15809?
atmel toolbox: downgrade or apply the listed mitigation; idprotect: mitigate or apply the listed mitigation; s\/a idflex v: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-15809 being exploited?
CVE-2019-15809 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-15809 affect?
CVE-2019-15809 affects atmel toolbox, idprotect, s\/a idflex v. Severity is medium (CVSS 4.7). Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to measure the duration of hundreds to
PatchTheCVE