PT-2014-4881 · Ekahau · Ekahau Activator+2

Published 2014-12-19 · Updated 2018-10-09 · CVE-2014-2716

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ekahau B4 staff badge tag version 5.7 with firmware 1.4.52 Ekahau Real-Time Location System (RTLS) Controller version 6.0.5-FINAL Ekahau Activator version 3

Description The issue allows remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts, due to the reuse of the RC4 cipher stream.

Recommendations For Ekahau B4 staff badge tag version 5.7 with firmware 1.4.52, consider disabling the use of RC4 cipher until a patch is available. For Ekahau Real-Time Location System (RTLS) Controller version 6.0.5-FINAL, restrict access to sensitive data to minimize the risk of exploitation. For Ekahau Activator version 3, avoid using the RC4 cipher in communication until the issue is resolved.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-2716

Affected Products

Ekahau Activator

Ekahau B4 Staff Badge Tag

Ekahau Real-Time Location System (Rtls) Controller

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-2716 · Security Note
• http://packetstormsecurity.com/files/129585/Ekahau-Real-Time-Location-System-RC4-Cipher-Stream-Reuse-Weak-Key-Derivation.html · Note
• http://securityfocus.com/archive/1/534241/100/0/threaded · Note
• http://securityfocus.com/bid/71674 · Note
• http://modzero.ch/advisories/MZ-14-01-Ekahau-RTLS.txt · Note