Dell EMC RSA BSAFE Micro Edition Suite up to 4.0.10/4.1.6.0 RSA Decryption Bleichenbacher cryptographic issue

Summaryinfo

A vulnerability, which was classified as critical, has been found in Dell EMC RSA BSAFE Micro Edition Suite up to 4.0.10/4.1.6.0. Affected by this vulnerability is an unknown functionality of the component RSA Decryption. Performing a manipulation results in cryptographic issue (Bleichenbacher). This vulnerability was named CVE-2018-11057. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Dell EMC RSA BSAFE Micro Edition Suite up to 4.0.10/4.1.6.0. This affects an unknown functionality of the component RSA Decryption. The manipulation with an unknown input leads to a cryptographic issue vulnerability (Bleichenbacher). CWE is classifying the issue as CWE-310. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key.

The bug was discovered 08/28/2018. The weakness was presented 08/31/2018 as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. This vulnerability is uniquely identified as CVE-2018-11057 since 05/14/2018. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 4.0.11 or 4.1.6.1 eliminates this vulnerability.

See VDB-123450, VDB-123451, VDB-123452 and VDB-124067 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Dell EMC

Name

• RSA BSAFE Micro Edition Suite

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6.0

License

• commercial

Website

• Vendor: https://www.dellemc.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion