vulnerability: RSA BSAFE SSL-J up to 6.1 Fingerprint Handler privilege escalation : 8/18/2015 12:47:56 PM

Group Chat & IM for Teams

Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >>

From our sponsors

Vulnerability Advisories

Vulnerabilities of scip VulDB

RSA BSAFE SSL-J up to 6.1 Fingerprint Handler privilege escalation
8/17/2015 7:00:00 PM

General

scipID: 77266
Affected: RSA BSAFE SSL-J up to 6.1
Published: 08/18/2015
Risk: critical

Created: 08/18/2015
Entry: 73% complete

Summary

A vulnerability classified as critical was found in RSA BSAFE SSL-J up to 6.1. This vulnerability affects an unknown function of the component Fingerprint Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was released 08/18/2015 as ESA-2015-081 as confirmed advisory (Website). This vulnerability was named CVE-2015-0534. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 6.2 eliminates this vulnerability. The vulnerability is also documented in the databases at X-Force (105651) and SecurityTracker (ID 1033297). The entries 77267 and 77268 are pretty similar.

CVSS

Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 5.0 (CVSS2#E:U/RL:OF/RC:C) [?]

CPE

Exploiting

Class: Privilege escalation
Local: No
Remote: Yes

Availability: No
Status: Unproven

Countermeasures

Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found

Upgrade: BSAFE SSL-J 6.2

Timeline

08/18/2015 | Advisory disclosed
08/18/2015 | VulDB entry created
08/18/2015 | SecurityTracker entry created
08/18/2015 | VulDB entry updated

Sources

Advisory: ESA-2015-081
Status: Confirmed

CVE: CVE-2015-0534 (mitre.org) (nvd.nist.org) (cvedetails.com)

X-Force: 105651 – Multiple RSA BSAFE products certificate security bypass
SecurityTracker: 1033297 – RSA BSAFE SSL-J Lets Remote Users Bypass Fingerprint Based Certificate Restrictions on the Target System