PT-2014-3026 · Emc · Emc Rsa Bsafe-C Toolkits+1

Publicado 2014-06-17 · Atualizado 2014-06-19 · CVE-2013-6078

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) version 20130918

Description The default configuration of the affected software uses the Dual Elliptic Curve Deterministic Random Bit Generation (Dual EC DRBG) algorithm, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging unspecified security concerns.

Recommendations For EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) version 20130918, consider changing the default configuration to use a different random bit generation algorithm to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the Dual EC DRBG algorithm until a more secure alternative is implemented.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-6078

Produtos afetados

Emc Rsa Bsafe-C Toolkits

Emc Rsa Data Protection Manager

Referências · 5

• http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html · Nota
• http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect · Nota
• http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6078 · Nota de Segurança
• http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers · Nota