-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
ESA-2017-146: RSA® Authentication Agent SDK for C Error Handling Vulnerability
EMC Identifier: ESA-2017-146
CVE Identifier: CVE-2017-14378
Severity Rating: CVSS v3 Base Score: 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
(see note below)
Affected Products:
. RSA® Authentication Agent API 8.5 for C
. RSA® Authentication Agent SDK 8.6 for C
Summary:
A security vulnerability in RSA Authentication Agent API/SDK for C versions 8.5
and 8.6 could potentially lead to authentication bypass in certain limited
implementations.
Details:
RSA Authentication Agent API/SDK 8.5/8.6 for C has an error handling flaw that
could lead to authentication bypass in certain limited implementations. This
issue will occur when the API/SDK is used in TCP asynchronous mode and return
codes from the API/SDK are not handled properly by the application.
Implementations handling the API/SDK return codes appropriately (per coding
guidelines documented in the RSA Authentication Agent API for C Developer's
Guide) are not vulnerable. Refer to KB article 000035762
(https://community.rsa.com/docs/DOC-85061) for information on how to inspect
your implementation and additional guidance on proper handling of API/SDK
return codes.
For clarification purposes, this issue does not impact:
. RSA Authentication Agent API/SDK for Java
. RSA Authentication Agent API for C versions prior to v8.5
. RSA Authentication Manager SDK and RSA SecurID® Mobile SDK.
Note: The CVSSv3 base score and vectors provided above are calculated based on
maximum impact for vulnerable implementations. RSA recommends that all impacted
customers take into account the base score (re-calculated for their own
vulnerable implementation) and any temporal and/or environmental scores that
may be relevant to their environment to assess their overall risk.
Recommendation:
The following releases contain resolution for this vulnerability:
. RSA Authentication Agent API 8.5.1 for C
. RSA Authentication Agent SDK 8.6.1 for C
RSA recommends all impacted customers upgrade at the earliest opportunity
and/or ensure that their implementation of the API/SDK conforms to the coding
guidelines documented in the RSA Authentication Agent API for C Developer's
Guide. RSA Authentication Agent API/SDK downloads and documentation can be
found at https://community.rsa.com/docs/DOC-40601#agents
Severity Rating:
For an explanation of Severity Ratings, refer to the Security Advisories
Severity Rating knowledge base article
(https://community.rsa.com/docs/DOC-47147). RSA recommends all customers take
into account both the base score and any relevant temporal and environmental
scores which may impact the potential severity associated with particular
security vulnerability.
EOPS Policy:
RSA has a defined End of Primary Support policy associated with all major
versions. Please refer to the Product Version Life Cycle
(https://community.rsa.com/docs/DOC-40387) for additional details.
RSA Link Security Advisories:
Read and use the information in this RSA Security Advisory to assist in
avoiding any situation that might arise from the problems described herein. If
you have any questions regarding this product alert, contact RSA Software
Technical Support at 1-800-995-5095. RSA Security LLC and its affiliates,
including without limitation, its ultimate parent company, Dell Technologies,
distribute RSA Security Advisories in order to bring to the attention of users
of the affected RSA products, important security information. RSA recommends
that all users determine the applicability of this information to their
individual situations and take appropriate action. The information set forth
herein is provided "as is" without warranty of any kind. RSA disclaims all
warranties, either express or implied, including the warranties of
merchantability, fitness for a particular purpose, title and non-infringement.
In no event shall RSA, its affiliates or its suppliers, be liable for any
damages whatsoever including direct, indirect, incidental, consequential, loss
of business profits or special damages, even if RSA, its affiliates or its
suppliers have been advised of the possibility of such damages. Some
jurisdictions do not allow the exclusion or limitation of liability for
consequential or incidental damages, so the foregoing limitation may not apply.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJaHEOVAAoJEHbcu+fsE81ZXVUH/3ivANEQ7rMIUA+cOTQcXl6P
nDyTMSMxe9rOiyc2VrfD5GhRgeXyQLcJMoBA0O21dYXpwIN4Tmcn9ze4THP9TeBq
nXRaSHYovW4b6ZhABl873WAeBf5Uqu4cFCoyey0r6wh6q3sOtnEKmengMx+pfVj8
gjus/Y/a/wBHC+LYKASb84LPuW7XOkvn7wnSMq1pXUEKeoapGnYhxa/kfPr+GDO0
+HNGbdIuNeJ20Uwne5R8FdecqZu0ThhkuHKCFdk7jVH0KYgW5zynQCepwjmVoWz4
qBXnhGC6r4dU4RIrHHx8b0wLF6r324kyf9BIONGzLdO24TLY3omQFnOE7ABwoac=
=Cr7Q
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
