CVE-2011-2740 in Rsa Key Manager Appliance
Summary
by MITRE
EMC RSA Key Manager (RKM) Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/25/2018
The vulnerability identified as CVE-2011-2740 affects the EMC RSA Key Manager appliance version 2.7 SP1 and earlier, specifically when accessed through Firefox 4.x or 5.0 browsers. This security flaw represents a session management weakness that fundamentally undermines the authentication and authorization controls of the system. The issue arises from improper session termination mechanisms that fail to effectively invalidate user sessions during the logout process, creating a persistent security risk that can be exploited by remote attackers.
The technical flaw manifests in the appliance's inability to properly clear session state information when users attempt to log out through the Firefox browser interface. This failure creates a scenario where session tokens, cookies, or other authentication artifacts remain active in memory or cache, allowing unauthorized access to remain possible even after legitimate users have attempted to end their sessions. The vulnerability specifically impacts the browser-based management interface of the RSA Key Manager appliance, where users navigate to the logout function to terminate their administrative sessions.
From an operational perspective, this vulnerability significantly increases the attack surface for remote exploitation, particularly on unattended workstations where users may leave systems logged in after completing their tasks. Attackers can leverage this weakness to execute arbitrary code on the appliance by simply accessing an already authenticated session that should have been terminated. The risk is amplified because the appliance handles sensitive cryptographic key management functions, making it a prime target for adversaries seeking to compromise key infrastructure. This vulnerability directly relates to CWE-613, which addresses insufficient session expiration, and aligns with ATT&CK technique T1566.001 for initial access through credential harvesting.
The security implications extend beyond simple unauthorized access to encompass potential privilege escalation and data compromise scenarios. Since the RSA Key Manager appliance is responsible for managing cryptographic keys that secure sensitive information, an attacker who successfully maintains an active session could potentially access, modify, or exfiltrate key material. The vulnerability is particularly concerning in enterprise environments where these appliances are often deployed to manage critical security infrastructure components, as it provides attackers with a persistent foothold that can be maintained across system reboots or administrative actions.
Organizations should implement immediate mitigations including upgrading to EMC RSA Key Manager appliance version 2.7.1.6 or later, which contains the necessary session management fixes. Additionally, administrators should enforce strict workstation security policies requiring users to manually lock their screens when stepping away from systems, implement automated screen locking mechanisms, and regularly audit session activity logs to detect potential unauthorized access attempts. Network segmentation and access controls should also be strengthened to limit exposure of the appliance to only authorized users and systems. The remediation efforts should include comprehensive testing to ensure that the session termination functionality operates correctly across all supported browser versions, and regular security assessments to validate that similar session management issues do not exist in other components of the cryptographic infrastructure.