PT-2014-3026 · Emc · Emc Rsa Bsafe-C Toolkits+1

Published 2014-06-17 · Updated 2014-06-19 · CVE-2013-6078

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) version 20130918

Description The default configuration of the affected software uses the Dual Elliptic Curve Deterministic Random Bit Generation (Dual EC DRBG) algorithm, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging unspecified security concerns.

Recommendations For EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) version 20130918, consider changing the default configuration to use a different random bit generation algorithm to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the Dual EC DRBG algorithm until a more secure alternative is implemented.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-6078

Affected Products

Emc Rsa Bsafe-C Toolkits

Emc Rsa Data Protection Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-6078 · Security Note
• http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html · Note
• http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect · Note
• http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655 · Note
• http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers · Note