PT-2018-3428 · Rsa · Emc Rsa Bsafe Micro Edition Suite

Published 2018-11-16 · Updated 2022-04-18 · CVE-2018-15769

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: RSA BSAFE Micro Edition Suite versions prior to 4.0.11 RSA BSAFE Micro Edition Suite versions prior to 4.1.6.2

Description: The issue is related to errors in managing cryptographic keys. It may allow a remote attacker to cause a denial of service. A malicious TLS server could potentially cause this issue on TLS clients during the handshake when a very large prime value is sent to the TLS client, and an Ephemeral or Anonymous Diffie-Hellman cipher suite (DHE or ADH) is used.

Recommendations: For RSA BSAFE Micro Edition Suite versions prior to 4.0.11, update to version 4.0.11 or later. For RSA BSAFE Micro Edition Suite versions prior to 4.1.6.2, update to version 4.1.6.2 or later.

Fix

Weakness Enumeration

CWE-320

Related Identifiers

BDU:2020-01103

CVE-2018-15769

Affected Products

Emc Rsa Bsafe Micro Edition Suite

References · 12

• https://bdu.fstec.ru/vul/2020-01103 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15769 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2020.html · Patch
• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-15769 · Security Note
• https://oracle.com/security-alerts/cpujul2020.html · Patch
• https://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Patch
• https://oracle.com/security-alerts/cpuapr2020.html · Patch
• http://securityfocus.com/bid/105929 · Note
• http://securitytracker.com/id/1042057 · Note
• https://seclists.org/fulldisclosure/2018/Nov/37 · Note
• https://oracle.com/security-alerts/cpujul2019.html · Note