PT-2018-3354 · Rsa+1 · Emc Rsa Bsafe Micro Edition Suite+4
Publicado
2018-08-31
·
Atualizado
2022-04-18
·
CVE-2018-11057
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x)
RSA BSAFE Micro Edition Suite versions prior to 4.1.6.1 (in 4.1.x)
Oracle Security Service (affected versions not specified)
Oracle Database Server (affected versions not specified)
Oracle Communications IP Service Activator (affected versions not specified)
Enterprise Manager Ops Center (affected versions not specified)
Description:
The issue is related to a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. This allows a remote attacker to potentially recover an RSA key. The vulnerability is associated with the use of defective cryptographic algorithms. Exploitation of the vulnerability may enable a remote attacker to recover an RSA key using the TCPS/HTTPS protocol.
Recommendations:
For RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x), update to version 4.0.11 or later.
For RSA BSAFE Micro Edition Suite versions prior to 4.1.6.1 (in 4.1.x), update to version 4.1.6.1 or later.
For Oracle Security Service, Oracle Database Server, Oracle Communications IP Service Activator, and Enterprise Manager Ops Center, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of a Broken Cryptographic Algorithm
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Enterprise Manager Ops Center
Oracle Communications Ip Service Activator
Oracle Database Server
Oracle Security Service
Emc Rsa Bsafe Micro Edition Suite