PT-2013-2735 · Rsa+3 · Rsa Pam Agent+6

Published 2013-05-22 · Updated 2013-05-23 · CVE-2013-0941

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA Authentication API versions prior to 8.1 SP1 RSA Web Agent for Apache Web Server versions prior to 5.3.5 RSA Web Agent for IIS versions prior to 5.3.5 RSA PAM Agent versions prior to 7.0 RSA Agent for Microsoft Windows versions prior to 6.1.4

Description The issue is related to the use of an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API. This allows local users to obtain sensitive information via cryptographic attacks on this data.

Recommendations For EMC RSA Authentication API versions prior to 8.1 SP1, update to version 8.1 SP1 or later. For RSA Web Agent for Apache Web Server versions prior to 5.3.5, update to version 5.3.5 or later. For RSA Web Agent for IIS versions prior to 5.3.5, update to version 5.3.5 or later. For RSA PAM Agent versions prior to 7.0, update to version 7.0 or later. For RSA Agent for Microsoft Windows versions prior to 6.1.4, update to version 6.1.4 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-0941

Affected Products

Apache Web Server

Emc Rsa Authentication Agent Api

Windows

Rsa Agent For Microsoft Windows

Rsa Pam Agent

Rsa Web Agent For Apache Web Server

Rsa Web Agent For Iis

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-0941 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2013-05/0064.html · Note