Date: Mon, 27 Nov 2017 17:04:36 +0000
From: EMC Product Security Response Center <Security_Alert@....com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] ESA-2017-146: RSA® Authentication Agent SDK for C Error Handling Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ESA-2017-146: RSA® Authentication Agent SDK for C Error Handling Vulnerability

EMC Identifier:  ESA-2017-146
CVE Identifier:  CVE-2017-14378
 
Severity Rating: CVSS v3 Base Score: 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) (see note below)
 
Affected Products:
	.	RSA® Authentication Agent API 8.5 for C
	.	RSA® Authentication Agent SDK 8.6 for C
 
Summary:
A security vulnerability in RSA Authentication Agent API/SDK for C versions 8.5 and 8.6 could potentially lead to authentication bypass in certain limited implementations.
 
Details:
RSA Authentication Agent API/SDK 8.5/8.6 for C has an error handling flaw that could lead to authentication bypass in certain limited implementations. This issue will occur when the API/SDK is used in TCP asynchronous mode and return codes from the API/SDK are not handled properly by the application.
 
Implementations handling the API/SDK return codes appropriately (per coding guidelines documented in the  RSA Authentication Agent API for C Developer's Guide) are not vulnerable. Refer to KB article 000035762 (https://community.rsa.com/docs/DOC-85061) for information on how to inspect your implementation and additional guidance on proper handling of API/SDK return codes.
 
For clarification purposes, this issue does not impact:
	.	RSA Authentication Agent API/SDK for Java
	.	RSA Authentication Agent API for C versions prior to v8.5
	.	RSA Authentication Manager SDK and RSA SecurID® Mobile SDK.
 
Note: The CVSSv3 base score and vectors provided above are calculated based on maximum impact for vulnerable implementations. RSA recommends that all impacted customers take into account the base score (re-calculated for their own vulnerable implementation) and any temporal and/or environmental scores that may be relevant to their environment to assess their overall risk.
 
Recommendation:
The following releases contain resolution for this vulnerability:
	.	RSA Authentication Agent API 8.5.1 for C
	.	RSA Authentication Agent SDK 8.6.1 for C
 
RSA recommends all impacted customers upgrade at the earliest opportunity and/or ensure that their implementation of the API/SDK conforms to the coding guidelines documented in the RSA Authentication Agent API for C Developer's Guide. RSA Authentication Agent API/SDK downloads and documentation can be found at https://community.rsa.com/docs/DOC-40601#agents
 
Severity Rating:
For an explanation of Severity Ratings, refer to the Security Advisories Severity Rating  knowledge base article (https://community.rsa.com/docs/DOC-47147). RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
 
EOPS Policy:
RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle (https://community.rsa.com/docs/DOC-40387) for additional details.
 
RSA Link Security Advisories:
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1-800-995-5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell Technologies, distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJaHEOVAAoJEHbcu+fsE81ZXVUH/3ivANEQ7rMIUA+cOTQcXl6P
nDyTMSMxe9rOiyc2VrfD5GhRgeXyQLcJMoBA0O21dYXpwIN4Tmcn9ze4THP9TeBq
nXRaSHYovW4b6ZhABl873WAeBf5Uqu4cFCoyey0r6wh6q3sOtnEKmengMx+pfVj8
gjus/Y/a/wBHC+LYKASb84LPuW7XOkvn7wnSMq1pXUEKeoapGnYhxa/kfPr+GDO0
+HNGbdIuNeJ20Uwne5R8FdecqZu0ThhkuHKCFdk7jVH0KYgW5zynQCepwjmVoWz4
qBXnhGC6r4dU4RIrHHx8b0wLF6r324kyf9BIONGzLdO24TLY3omQFnOE7ABwoac=
=Cr7Q
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists