PT-2017-9536 · Emc · Emc Rsa Bsafe Crypto-J

Published 2017-02-03 · Updated 2021-12-16 · CVE-2016-8217

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE Crypto-J versions prior to 6.2.2

Description The issue allows for a possible timing attack by modifying a PKCS#12 file with an unknown password, enabling an attacker to guess the current MAC one byte at a time. This is due to the use of a non-constant-time method for comparing the stored MAC with the calculated MAC.

Recommendations For versions prior to 6.2.2, update to version 6.2.2 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-8217

Affected Products

Emc Rsa Bsafe Crypto-J

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-8217 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8217 · Vendor Advisory
• http://securitytracker.com/id/1037732 · Note
• http://securityfocus.com/archive/1/540066/30/0/threaded · Note
• http://securityfocus.com/bid/95831 · Note