PT-2016-4476 · Emc · Emc Rsa Bsafe Micro Edition Suite

Published 2016-09-18 · Updated 2021-12-16 · CVE-2016-0923

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE Micro Edition Suite (MES) versions 4.0.x through 4.0.8 EMC RSA BSAFE Micro Edition Suite (MES) versions 4.1.x through 4.1.4

Description The issue concerns the client in EMC RSA BSAFE Micro Edition Suite (MES) that places the weakest algorithms first in a signature-algorithm list transmitted to a server. This behavior makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server behavior in which the first algorithm is used.

Recommendations For versions 4.0.x through 4.0.8, update to version 4.0.9 or later. For versions 4.1.x through 4.1.4, update to version 4.1.5 or later.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2016-0923

Affected Products

Emc Rsa Bsafe Micro Edition Suite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-0923 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0923 · Vendor Advisory
• http://securitytracker.com/id/1036835 · Note
• http://seclists.org/bugtraq/2016/Sep/25 · Note
• http://securityfocus.com/bid/92994 · Note