PT-2017-18064 · Emc · Emc Rsa Authentication Manager

Published 2017-07-17 · Updated 2017-08-10 · CVE-2017-8006

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EMC RSA Authentication Manager versions 8.2 SP1 Patch 1 and earlier

Description A malicious user logged into the Self-Service Console of RSA Authentication Manager can use a brute force attack to attempt to identify a target user's PIN. This could potentially allow the malicious user to reset the compromised PIN, affecting the victim's ability to obtain access to protected resources.

Recommendations For EMC RSA Authentication Manager versions 8.2 SP1 Patch 1 and earlier, consider implementing additional security measures to prevent brute force attacks, such as rate limiting or IP blocking, until a patch is available. As a temporary workaround, restrict access to the Self-Service Console to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-8006

Affected Products

Emc Rsa Authentication Manager

References · 5

• https://osv.dev/vulnerability/CVE-2017-8006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8006 · Security Note
• http://securitytracker.com/id/1038879 · Note
• http://securityfocus.com/bid/99554 · Note
• http://seclists.org/fulldisclosure/2017/Jul/23 · Note