PT-2013-2735 · Rsa+3 · Rsa Pam Agent+6

Publicado 2013-05-22 · Atualizado 2013-05-23 · CVE-2013-0941

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA Authentication API versions prior to 8.1 SP1 RSA Web Agent for Apache Web Server versions prior to 5.3.5 RSA Web Agent for IIS versions prior to 5.3.5 RSA PAM Agent versions prior to 7.0 RSA Agent for Microsoft Windows versions prior to 6.1.4

Description The issue is related to the use of an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API. This allows local users to obtain sensitive information via cryptographic attacks on this data.

Recommendations For EMC RSA Authentication API versions prior to 8.1 SP1, update to version 8.1 SP1 or later. For RSA Web Agent for Apache Web Server versions prior to 5.3.5, update to version 5.3.5 or later. For RSA Web Agent for IIS versions prior to 5.3.5, update to version 5.3.5 or later. For RSA PAM Agent versions prior to 7.0, update to version 7.0 or later. For RSA Agent for Microsoft Windows versions prior to 6.1.4, update to version 6.1.4 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-0941

Produtos afetados

Apache Web Server

Emc Rsa Authentication Agent Api

Windows

Rsa Agent For Microsoft Windows

Rsa Pam Agent

Rsa Web Agent For Apache Web Server

Rsa Web Agent For Iis

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-0941 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2013-05/0064.html · Nota