Details of VAR-201608-0041

ID

VAR-201608-0041

CVE

CVE-2016-6257

TITLE

plural Lenovo Used in products Lenovo Ultraslim Dongle firmware vulnerabilities that allow encrypted keyboard input to be inserted into the system

Trust: 0.8

sources: JVNDB: JVNDB-2016-004163

DESCRIPTION

The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack.". This vulnerability "KeyJack Injection attack " It is called.By using a dongle operation, a third party could insert encrypted keyboard input into the system. LenovoWirelessMouseBlack and others are products of Lenovo's wireless desktop package with mouse and keyboard. Remote security vulnerabilities exist in several Lenovo products, which can be exploited by an attacker using LenovoUltraslim Wireless's electronic dog to inject keyboard input. Multiple Lenovo Products are prone to a remote security vulnerability. Lenovo Liteon SK-8861, etc. are all products of China Lenovo. Lenovo Ultraslim dongles are a dongle

Trust: 2.52

sources: NVD: CVE-2016-6257 // JVNDB: JVNDB-2016-004163 // CNVD: CNVD-2016-05943 // BID: 92179 // VULHUB: VHN-95077

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-05943

AFFECTED PRODUCTS

vendor:	amazonbasics	model:	usb dongle	scope:	-	version:	-	Trust: 1.6
vendor:	lenovo	model:	ultraslim dongle	scope:	-	version:	-	Trust: 1.6
vendor:	logitech	model:	unifying dongle	scope:	-	version:	-	Trust: 1.6
vendor:	dell	model:	km632 usb dongle	scope:	-	version:	-	Trust: 1.6
vendor:	dell	model:	km714 usb dongle	scope:	-	version:	-	Trust: 1.6
vendor:	lenovo	model:	ultraslim	scope:	eq	version:	-	Trust: 1.6
vendor:	logitech	model:	unifying	scope:	lte	version:	012.005.00028	Trust: 1.0
vendor:	dell	model:	km714	scope:	lte	version:	012.005.00028	Trust: 1.0
vendor:	logitech	model:	unifying	scope:	lte	version:	024.003.00027	Trust: 1.0
vendor:	dell	model:	km632	scope:	eq	version:	-	Trust: 1.0
vendor:	amazonbasics	model:	-	scope:	eq	version:	-	Trust: 1.0
vendor:	amazonbasics	model:	wireless keyboard	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ultraslim wireless keyboard	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	km632 wireless mouse	scope:	-	version:	-	Trust: 0.8
vendor:	dell	model:	km714 wireless keyboard & mouse	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	wireless mouse black	scope:	-	version:	-	Trust: 0.6
vendor:	lenovo	model:	wireless mouse black	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	wireless keyboard black	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	silver silk 2.4g kb -black	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	liteon ztm600 2.4g mouse	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	liteon sk-8861 2.4g	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2016-05943 // BID: 92179 // JVNDB: JVNDB-2016-004163 // CNNVD: CNNVD-201607-1048 // NVD: CVE-2016-6257

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-6257
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-6257
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2016-05943
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201607-1048
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-95077
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2016-6257
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-05943
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-95077
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-6257
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2016-6257
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2016-05943 // VULHUB: VHN-95077 // JVNDB: JVNDB-2016-004163 // CNNVD: CNNVD-201607-1048 // NVD: CVE-2016-6257

PROBLEMTYPE DATA

problemtype:

CWE-310

Trust: 1.9

sources: VULHUB: VHN-95077 // JVNDB: JVNDB-2016-004163 // NVD: CVE-2016-6257

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201607-1048

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201607-1048

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-004163

PATCH

title:	LEN-7267	url:	https://support.lenovo.com/jp/ja/product_security/len_7267	Trust: 0.8
title:	Logitech Response to Unifying Receiver/G900 Mouse Research Findings	url:	https://community.logitech.com/s/question/0D531000058b3B7CAI	Trust: 0.8
title:	Patches for multiple Lenovo product remote vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/80049	Trust: 0.6
title:	Lenovo Ultraslim Repair measures for protector security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=63358	Trust: 0.6

sources: CNVD: CNVD-2016-05943 // JVNDB: JVNDB-2016-004163 // CNNVD: CNNVD-201607-1048

EXTERNAL IDS

db:	NVD	id:	CVE-2016-6257	Trust: 3.4
db:	BID	id:	92179	Trust: 2.6
db:	JVNDB	id:	JVNDB-2016-004163	Trust: 0.8
db:	CNNVD	id:	CNNVD-201607-1048	Trust: 0.7
db:	CNVD	id:	CNVD-2016-05943	Trust: 0.6
db:	VULHUB	id:	VHN-95077	Trust: 0.1

sources: CNVD: CNVD-2016-05943 // VULHUB: VHN-95077 // BID: 92179 // JVNDB: JVNDB-2016-004163 // CNNVD: CNNVD-201607-1048 // NVD: CVE-2016-6257

REFERENCES

url:	https://github.com/bastilleresearch/keyjack/blob/master/doc/advisories/bastille-13.lenovo-ultraslim.public.txt	Trust: 2.5
url:	https://www.bastille.net/research/vulnerabilities/keyjack	Trust: 2.5
url:	http://www.securityfocus.com/bid/92179	Trust: 2.3
url:	https://support.lenovo.com/product_security/len_7267	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6257	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6257	Trust: 0.8
url:	https://github.com/bastilleresearch/keyjack/blob/master/doc/advisories/bastille-13.amazon-basics.public.txt	Trust: 0.8
url:	https://github.com/bastilleresearch/keyjack/blob/master/doc/advisories/bastille-13.dell-km632.public.txt	Trust: 0.8
url:	https://github.com/bastilleresearch/keyjack/blob/master/doc/advisories/bastille-13.dell-km714.public.txt	Trust: 0.8
url:	https://github.com/bastilleresearch/keyjack/blob/master/doc/advisories/bastille-13.logitech.public.txt	Trust: 0.8
url:	http://www.lenovo.com/ca/en/	Trust: 0.3
url:	https://support.lenovo.com/us/en/product_security/len_7267	Trust: 0.3

sources: CNVD: CNVD-2016-05943 // VULHUB: VHN-95077 // BID: 92179 // JVNDB: JVNDB-2016-004163 // CNNVD: CNNVD-201607-1048 // NVD: CVE-2016-6257

CREDITS

Marc Newlin from Bastille Threat Research Team.

Trust: 0.9

sources: BID: 92179 // CNNVD: CNNVD-201607-1048

SOURCES

db:	CNVD	id:	CNVD-2016-05943
db:	VULHUB	id:	VHN-95077
db:	BID	id:	92179
db:	JVNDB	id:	JVNDB-2016-004163
db:	CNNVD	id:	CNNVD-201607-1048
db:	NVD	id:	CVE-2016-6257

LAST UPDATE DATE

2025-04-13T23:38:59.361000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-05943	date:	2016-08-03T00:00:00
db:	VULHUB	id:	VHN-95077	date:	2016-08-12T00:00:00
db:	BID	id:	92179	date:	2016-07-28T00:00:00
db:	JVNDB	id:	JVNDB-2016-004163	date:	2016-08-09T00:00:00
db:	CNNVD	id:	CNNVD-201607-1048	date:	2021-04-23T00:00:00
db:	NVD	id:	CVE-2016-6257	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-05943	date:	2016-08-03T00:00:00
db:	VULHUB	id:	VHN-95077	date:	2016-08-02T00:00:00
db:	BID	id:	92179	date:	2016-07-28T00:00:00
db:	JVNDB	id:	JVNDB-2016-004163	date:	2016-08-09T00:00:00
db:	CNNVD	id:	CNNVD-201607-1048	date:	2016-07-28T00:00:00
db:	NVD	id:	CVE-2016-6257	date:	2016-08-02T14:59:04.490