BugTraq
ESA-2016-154: RSA BSAFE® Crypto-J Multiple Security Vulnerabilities Jan 26 2017 05:54PM
EMC Product Security Response Center (Security_Alert emc com)

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256

ESA-2016-154: RSA BSAFE® Crypto-J Multiple Security Vulnerabilities

EMC Identifier: ESA-2016-154

CVE Identifier: CVE-2016-8212, CVE-2016-8217

Severity Rating: See below for scores for individual issues

Affected Products:

? RSA BSAFE Crypto-J versions prior to 6.2.2

Unaffected Products:

? RSA BSAFE Crypto-J 6.2.2

Summary:

RSA announces security fixes to RSA BSAFE® Crypto-J designed to address two security vulnerabilities in the Crypto-J JCE cryptographic provider.

Details:

? Improper OCSP Validation Vulnerability ( CVE-2016-8212)

OCSP responses have two time values; thisUpdate and nextUpdate. These specify a validity period, however both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.

CVSS v3 Base Score: 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

? PKCS#12 Timing Attack Vulnerability (CVE-2016-8217)

A possible timing attack could be carried out by modifying a PKCS#12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS#12 file to the toolkit and guess the current MAC one by at a time. This is possible because Crypto-J uses a non-constant-time method to compare the stored MAC with the calculated MAC. This vulnerability is similar to the issue described in CVE-2015-2601.

CVSS v3 Base Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Recommendation:

The below version contains a fix for the above issues

? RSA BSAFE Crypto-J 6.2.2 and later

RSA recommends affected customers upgrade to the version listed above at the earliest opportunity.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2

iQEcBAEBCAAGBQJYiiGvAAoJEHbcu+fsE81ZJ0IH/3r30u14Q5OGi0fImLikb1kI

Hi2SVY+oO56eDtB1H5ivjWqvCabTy9KiwcsPTLx7eGO88ujQ5a0/BH3FjQooCUOM

spa6f8OEKtjhUtJrDS0Hi0UxRcoPlpsuqNnSdrR50/5lgkSfVD2neGCDq3iXyVcU

2uAkxQ9VvETJ5y/R7kEWIrr4QfUZXvb4N9/oclIbsy2hLPYuGN/rx9K2xuN3b0yT

0XaDvL0N08IPrZJbUvTW0C7i0qexaVWMVUqYMDdq2jrnp0X4t5VwlXgO/hOD3HRo

6bvvePtf4N2sipEu3bc0g8JuuzOzy0Xz3wQdEKtUf1qXDa9+RiY+uiDdPY9EJyY=

=JEwf

-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus