CVE-2020-9063 : Security Advisory and Response

NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier are vulnerable to a buffer overflow attack, allowing an attacker to execute arbitrary code with SYSTEM privileges.

Understanding CVE-2020-9063

NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier are susceptible to unauthorized code execution due to a lack of USB HID communication integrity.

What is CVE-2020-9063?

This CVE describes a vulnerability in NCR SelfServ ATMs that enables attackers with physical access to inject malicious payloads and execute arbitrary code on the host computer.

The Impact of CVE-2020-9063

The vulnerability allows attackers to exploit USB HID communications between the currency dispenser and the host computer, leading to unauthorized code execution with SYSTEM privileges.

Technical Details of CVE-2020-9063

NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier are affected by a critical security flaw.

Vulnerability Description

The vulnerability arises from the lack of authentication and integrity protection in USB HID communications, enabling attackers to perform a buffer overflow attack.

Affected Systems and Versions

Product: SelfServ ATM
Vendor: NCR
Versions Affected: APTRA XFS 05.01.00 and earlier

Exploitation Mechanism

Attackers with physical access to internal ATM components can inject malicious payloads, causing a buffer overflow on the host and executing arbitrary code with SYSTEM privileges.

Mitigation and Prevention

Immediate action is crucial to mitigate the risks posed by CVE-2020-9063.

Immediate Steps to Take

Update to the latest version of APTRA XFS to patch the vulnerability.
Implement physical security measures to restrict unauthorized access to ATM components.
Monitor ATM systems for any suspicious activities.

Long-Term Security Practices

Regularly update and patch ATM software to address security vulnerabilities.
Conduct security training for ATM operators to enhance awareness of potential threats.

Patching and Updates

Apply security patches provided by NCR promptly to address the vulnerability and enhance system security.