vulnerability: RSA BSAFE Crypto-C up to 4.0.3/4.1 Base64 Decoding Integer buffer overflow : 8/18/2015 12:47:55 PM

Group Chat & IM for Teams

Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >>

From our sponsors

Vulnerability Advisories

Vulnerabilities of scip VulDB

RSA BSAFE Crypto-C up to 4.0.3/4.1 Base64 Decoding Integer buffer overflow
8/17/2015 7:00:00 PM

General

scipID: 77268
Affected: RSA BSAFE Crypto-C up to 4.0.3/4.1
Published: 08/18/2015
Risk: critical

Created: 08/18/2015
Entry: 74% complete

Summary

A vulnerability, which was classified as critical, was found in RSA BSAFE Crypto-C up to 4.0.3/4.1. Affected is an unknown function of the component Base64 Decoding. The manipulation with an unknown input leads to a buffer overflow vulnerability (integer). This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 08/18/2015 as ESA-2015-081 as confirmed advisory (Website). This vulnerability is traded as CVE-2015-0537. It is possible to launch the attack remotely. The exploitation doesn’t require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 4.0.4 eliminates this vulnerability. The vulnerability is also documented in the databases at X-Force (105654) and SecurityTracker (ID 1033299). Similar entries are available at 77266 and 77267.

CVSS

Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 5.0 (CVSS2#E:U/RL:OF/RC:C) [?]

CPE

Exploiting

Class: Buffer overflow
Local: No
Remote: Yes

Availability: No
Status: Unproven

Countermeasures

Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found

Upgrade: BSAFE Crypto-C 4.0.4

Timeline

08/18/2015 | Advisory disclosed
08/18/2015 | VulDB entry created
08/18/2015 | SecurityTracker entry created
08/18/2015 | VulDB entry updated

Sources

Advisory: ESA-2015-081
Status: Confirmed

CVE: CVE-2015-0537 (mitre.org) (nvd.nist.org) (cvedetails.com)

X-Force: 105654 – Multiple RSA BSAFE products integer underflow
SecurityTracker: 1033299 – RSA BSAFE Crypto-C Integer Overflow in Base64 Decoding Implementation Lets Remote Users Deny Service