medium6.5
CVE-2016-6257
The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wir…
Impact
The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Amazonbasics | Firmware | All versions |
| Dell | Km714 Firmware | through 012.005.00028 |
| Dell | Km632 Firmware | All versions |
| Logitech | Unifying Firmware | through 012.005.00028 through 024.003.00027 |
| Lenovo | Ultraslim Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/92179
- https://github.com/BastilleResearch/keyjack/blob/master/doc/advisories/bastille-13.lenovo-ultraslim.public.txt
- https://support.lenovo.com/product_security/len_7267
- https://www.bastille.net/research/vulnerabilities/keyjack
- http://www.securityfocus.com/bid/92179
- https://github.com/BastilleResearch/keyjack/blob/master/doc/advisories/bastille-13.lenovo-ultraslim.public.txt
- https://support.lenovo.com/product_security/len_7267
- https://www.bastille.net/research/vulnerabilities/keyjack