vulnerability: RSA BSAFE Crypto-J up to 6.1 Fingerprint Handler privilege escalation : 8/18/2015 12:47:55 PM

DataNerd

Create a free account with New Relic and get this swanky shirt for FREE!

From our sponsors

Vulnerability Advisories

Vulnerabilities of scip VulDB

RSA BSAFE Crypto-J up to 6.1 Fingerprint Handler privilege escalation
8/17/2015 7:00:00 PM

General

scipID: 77267
Affected: RSA BSAFE Crypto-J up to 6.1
Published: 08/18/2015
Risk: critical

Created: 08/18/2015
Entry: 73.5% complete

Summary

A vulnerability, which was classified as critical, has been found in RSA BSAFE Crypto-J up to 6.1. This issue affects an unknown function of the component Fingerprint Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 08/18/2015 as ESA-2015-081 as confirmed advisory (Website). The advisory is shared for download at www.rsa.com/. The identification of this vulnerability is CVE-2015-0534. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.2 eliminates this vulnerability. The vulnerability is also documented in the databases at X-Force (105651) and SecurityTracker (ID 1033298). See 77266 and 77268 for similar entries.

CVSS

Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 5.0 (CVSS2#E:U/RL:OF/RC:C) [?]

CPE

Exploiting

Class: Privilege escalation
Local: No
Remote: Yes

Availability: No
Status: Unproven

Countermeasures

Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found

Upgrade: BSAFE Crypto-J 6.2

Timeline

08/18/2015 | Advisory disclosed
08/18/2015 | VulDB entry created
08/18/2015 | SecurityTracker entry created
08/18/2015 | VulDB entry updated

Sources

Advisory: ESA-2015-081
Status: Confirmed

CVE: CVE-2015-0534 (mitre.org) (nvd.nist.org) (cvedetails.com)

X-Force: 105651 – Multiple RSA BSAFE products certificate security bypass
SecurityTracker: 1033298 – RSA BSAFE Crypto-J Lets Remote Users Bypass Fingerprint Based Certificate Restrictions on the Target System