CVE-2011-2742 in RSA Adaptive Authentication On-Premise
Summary
by MITRE
EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile device.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 01/13/2018
The CVE-2011-2742 vulnerability affects EMC RSA Adaptive Authentication On-Premise 6.0.2.1 versions including various service packs and patches. This security flaw resides in the forensic evaluation mechanism that processes device tokens received from mobile applications. The vulnerability stems from inadequate validation of mobile device tokens during the authentication process, creating a potential attack vector for remote adversaries to circumvent application restrictions. The flaw specifically impacts the authentication system's ability to properly assess device characteristics and security posture when mobile tokens are submitted for verification.
The technical implementation of this vulnerability involves a failure in the device token forensic evaluation process within the RSA AAOP system. When mobile applications submit device tokens to the authentication server, the system should perform comprehensive forensic analysis to validate device authenticity and security configuration. However, the system fails to conduct proper forensic evaluation, allowing attackers to manipulate or forge device token submissions. This weakness enables unauthorized access by bypassing the intended security controls that should restrict application usage based on device characteristics and security policies. The vulnerability operates at the authentication validation layer, where device token integrity checks are insufficient to prevent malicious token manipulation.
The operational impact of CVE-2011-2742 extends beyond simple authentication bypass to potentially compromise entire application security frameworks. Attackers can exploit this vulnerability to gain unauthorized access to protected applications and services by submitting forged device tokens that appear legitimate to the authentication system. This weakness undermines the principle of least privilege and device-based access controls that organizations rely upon for security. The remote nature of the attack means that adversaries can exploit this vulnerability from outside the network perimeter, making it particularly dangerous for organizations that depend on mobile device authentication for access control. The vulnerability directly affects the authentication system's ability to enforce security policies and could lead to unauthorized data access, privilege escalation, and potential system compromise.
Organizations should implement multiple layers of mitigation strategies to address this vulnerability effectively. Immediate patching of affected RSA AAOP versions is essential, as EMC has released updates to correct the forensic evaluation implementation. Network segmentation and monitoring of authentication traffic can help detect anomalous device token submissions that might indicate exploitation attempts. Implementing additional authentication factors beyond device tokens, such as multi-factor authentication, can reduce the impact of this vulnerability. Security monitoring should focus on unusual authentication patterns and device token validation failures that could indicate exploitation attempts. The vulnerability aligns with CWE-284, which addresses improper access control, and maps to ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting through mobile device manipulation. Regular security assessments of authentication systems and device token validation processes are crucial for maintaining security posture against similar implementation flaws.