A security issue has been reported in nCipher CHIL (Cryptographic Hardware Interface Library), which may result in a program generating the same random bytes in all child processes for a certain period of time.

The security issue is caused due to the "HWCryptoHook_RandomBytes()" function not clearing its cache of random bytes when a process calling the function forks. This causes each child process to use the same sequence of random bytes until they exhaust this cache.

Successful exploitation requires that the application forks child processes and is dependent on how CHIL is used in the application (e.g. child processes of a vulnerable application may generate the same session keys).

The security issue affects versions prior to 1.9.7.

Solution
Update to version 1.9.7 or later and re-link affected applications to the fixed library.

Provided and/or discovered by
Reported by vendor.

Original Advisory
nCipher:
http://www.ncipher.com/support/advisories/keysigs/advisory11.txt.asc

Deep Links
Links available in Customer Area