CVE-2010-3321 in Authentication Client
Summary
by MITRE
RSA Authentication Client 2.0.x, 3.0, and 3.5.x before 3.5.3 does not properly handle a SENSITIVE or NON-EXTRACTABLE tag on a secret key object that is stored on a SecurID 800 authenticator, which allows local users to bypass intended access restrictions and read keys via unspecified PKCS#11 API requests.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/06/2018
The vulnerability identified as CVE-2010-3321 affects RSA Authentication Client versions 2.0.x through 3.5.x prior to 3.5.3, specifically targeting the handling of cryptographic key objects stored on SecurID 800 authenticators. This issue stems from improper processing of cryptographic key attributes within the PKCS#11 API implementation, creating a significant security weakness that undermines the intended protection mechanisms of the authentication system. The flaw manifests when the client encounters secret key objects that contain SENSITIVE or NON-EXTRACTABLE tags, which are standard cryptographic attributes designed to prevent unauthorized access to key material.
The technical implementation flaw resides in the RSA Authentication Client's interpretation and handling of PKCS#11 API requests that interact with cryptographic objects stored on SecurID authenticators. When a key object is marked with SENSITIVE or NON-EXTRACTABLE attributes, these tags are typically enforced by PKCS#11 compliant systems to prevent extraction or unauthorized access to the underlying cryptographic material. However, the vulnerable RSA client versions fail to properly respect these security attributes, allowing local attackers to craft specific API requests that bypass the intended access controls. This misimplementation creates a path where attackers can extract or read cryptographic keys that should remain protected, effectively undermining the core security model of the authentication system.
The operational impact of this vulnerability is substantial as it allows local users to bypass access restrictions that are fundamental to the security architecture of RSA Authentication Client deployments. Attackers who can execute code on a system with the vulnerable client installed can exploit this weakness to access cryptographic keys stored on SecurID authenticators, potentially compromising the entire authentication infrastructure. This vulnerability directly violates the principle of least privilege and undermines the cryptographic protection mechanisms that are essential for maintaining secure authentication processes. The ability to read keys through unspecified PKCS#11 API requests creates a persistent threat that could enable attackers to impersonate legitimate users or decrypt sensitive communications.
From a cybersecurity perspective, this vulnerability aligns with CWE-254, which addresses weaknesses in cryptographic implementations related to improper handling of key attributes. The flaw also maps to ATT&CK technique T1552.001, which covers "Unsecured Credentials" through improper key handling mechanisms. Organizations using RSA Authentication Client in environments where local privilege escalation or code execution is possible face significant risk, as this vulnerability can be exploited without requiring network access or external attack vectors. The impact extends beyond individual system compromise to potentially affect entire authentication domains that rely on the SecurID 800 authenticator for secure key storage and management.
Mitigation strategies should focus on immediate patching to RSA Authentication Client versions 3.5.3 and later, which contain the necessary fixes for proper PKCS#11 API handling. System administrators should also implement additional monitoring for unusual PKCS#11 API activity and ensure that access controls on systems running the client are properly configured to limit local user privileges. Organizations should conduct thorough inventory assessments to identify all systems running vulnerable versions and implement network segmentation to limit potential attack surfaces. The vulnerability underscores the critical importance of proper cryptographic attribute handling in security implementations and demonstrates how seemingly minor flaws in API processing can create significant security weaknesses that compromise entire authentication systems.