PT-2001-2248 · Rsa · Rsa Bsafe Ssl-J

Published 2001-09-12 · Updated 2021-11-08 · CVE-2001-1105

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RSA BSAFE SSL-J versions 3.0 through 3.1

Description The issue allows remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure, due to the caching of session IDs from failed login attempts.

Recommendations For RSA BSAFE SSL-J versions 3.0 through 3.1, consider disabling the session ID caching mechanism to prevent attackers from bypassing SSL client authentication.

Fix

Related Identifiers

CVE-2001-1105

Affected Products

Rsa Bsafe Ssl-J

References · 6

• http://ciac.org/ciac/bulletins/l-141.shtml · Vendor Advisory
• http://securityfocus.com/bid/3329 · Vendor Advisory
• http://cisco.com/warp/public/707/SSL-J-pub.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1105 · Security Note
• http://rsasecurity.com/products/bsafe/bulletins/BSAFE_SSL-J_3.x.SecurityBulletin.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7112 · Note