PT-2018-2951 · Rsa · Emc Rsa Bsafe Micro Edition Suite+1

Published 2018-08-28 · Updated 2022-04-18 · CVE-2018-11058

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA BSAFE Micro Edition Suite versions prior to 4.0.11 RSA BSAFE Micro Edition Suite versions prior to 4.1.6 RSA BSAFE Crypto-C Micro Edition version prior to 4.0.5.3

Description The issue is caused by a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data to exploit this issue, potentially allowing the execution of arbitrary code in the context of the current user.

Recommendations For RSA BSAFE Micro Edition Suite versions prior to 4.0.11, update to version 4.0.11 or later. For RSA BSAFE Micro Edition Suite versions prior to 4.1.6, update to version 4.1.6 or later. For RSA BSAFE Crypto-C Micro Edition version prior to 4.0.5.3, update to version 4.0.5.3 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2019-02722

CVE-2018-11058

Affected Products

Rsa Bsafe Crypto-C Micro Edition

Emc Rsa Bsafe Micro Edition Suite

References · 11

• https://osv.dev/vulnerability/CVE-2018-11058 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2020.html · Patch
• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11058 · Security Note
• https://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Patch
• https://oracle.com/security-alerts/cpujul2020.html · Patch
• https://bdu.fstec.ru/vul/2019-02722 · Security Note
• https://oracle.com/security-alerts/cpuapr2020.html · Patch
• http://seclists.org/fulldisclosure/2018/Aug/46 · Note
• http://securityfocus.com/bid/108106 · Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note