Exploit the possiblities

RSA Authentication Agent SDK For C Error Handling

RSA Authentication Agent SDK For C Error Handling
Posted Nov 27, 2017
Site emc.com

A security vulnerability in RSA Authentication Agent API/SDK for C versions 8.5 and 8.6 could potentially lead to authentication bypass in certain limited implementations.

tags | advisory
advisories | CVE-2017-14378
MD5 | 3e6bdf73c327927b1f47dfe57fc570e6

RSA Authentication Agent SDK For C Error Handling

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ESA-2017-146: RSA(r) Authentication Agent SDK for C Error Handling Vulnerability

EMC Identifier: ESA-2017-146
CVE Identifier: CVE-2017-14378

Severity Rating: CVSS v3 Base Score: 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) (see note below)

Affected Products:
. RSA(r) Authentication Agent API 8.5 for C
. RSA(r) Authentication Agent SDK 8.6 for C

Summary:
A security vulnerability in RSA Authentication Agent API/SDK for C versions 8.5 and 8.6 could potentially lead to authentication bypass in certain limited implementations.

Details:
RSA Authentication Agent API/SDK 8.5/8.6 for C has an error handling flaw that could lead to authentication bypass in certain limited implementations. This issue will occur when the API/SDK is used in TCP asynchronous mode and return codes from the API/SDK are not handled properly by the application.

Implementations handling the API/SDK return codes appropriately (per coding guidelines documented in the RSA Authentication Agent API for C Developer's Guide) are not vulnerable. Refer to KB article 000035762 (https://community.rsa.com/docs/DOC-85061) for information on how to inspect your implementation and additional guidance on proper handling of API/SDK return codes.

For clarification purposes, this issue does not impact:
. RSA Authentication Agent API/SDK for Java
. RSA Authentication Agent API for C versions prior to v8.5
. RSA Authentication Manager SDK and RSA SecurID(r) Mobile SDK.

Note: The CVSSv3 base score and vectors provided above are calculated based on maximum impact for vulnerable implementations. RSA recommends that all impacted customers take into account the base score (re-calculated for their own vulnerable implementation) and any temporal and/or environmental scores that may be relevant to their environment to assess their overall risk.

Recommendation:
The following releases contain resolution for this vulnerability:
. RSA Authentication Agent API 8.5.1 for C
. RSA Authentication Agent SDK 8.6.1 for C

RSA recommends all impacted customers upgrade at the earliest opportunity and/or ensure that their implementation of the API/SDK conforms to the coding guidelines documented in the RSA Authentication Agent API for C Developer's Guide. RSA Authentication Agent API/SDK downloads and documentation can be found at https://community.rsa.com/docs/DOC-40601#agents

Severity Rating:
For an explanation of Severity Ratings, refer to the Security Advisories Severity Rating knowledge base article (https://community.rsa.com/docs/DOC-47147). RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.

EOPS Policy:
RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle (https://community.rsa.com/docs/DOC-40387) for additional details.

RSA Link Security Advisories:
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1-800-995-5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell Technologies, distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJaHEOVAAoJEHbcu+fsE81ZXVUH/3ivANEQ7rMIUA+cOTQcXl6P
nDyTMSMxe9rOiyc2VrfD5GhRgeXyQLcJMoBA0O21dYXpwIN4Tmcn9ze4THP9TeBq
nXRaSHYovW4b6ZhABl873WAeBf5Uqu4cFCoyey0r6wh6q3sOtnEKmengMx+pfVj8
gjus/Y/a/wBHC+LYKASb84LPuW7XOkvn7wnSMq1pXUEKeoapGnYhxa/kfPr+GDO0
+HNGbdIuNeJ20Uwne5R8FdecqZu0ThhkuHKCFdk7jVH0KYgW5zynQCepwjmVoWz4
qBXnhGC6r4dU4RIrHHx8b0wLF6r324kyf9BIONGzLdO24TLY3omQFnOE7ABwoac=
=Cr7Q
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    15 Files
  • 2
    Dec 2nd
    2 Files
  • 3
    Dec 3rd
    1 Files
  • 4
    Dec 4th
    15 Files
  • 5
    Dec 5th
    15 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    17 Files
  • 8
    Dec 8th
    15 Files
  • 9
    Dec 9th
    13 Files
  • 10
    Dec 10th
    4 Files
  • 11
    Dec 11th
    41 Files
  • 12
    Dec 12th
    44 Files
  • 13
    Dec 13th
    25 Files
  • 14
    Dec 14th
    10 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close