000035836 - CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products

Document created by RSA Customer Support Employee on Dec 12, 2017Last modified by RSA Customer Support Employee on Aug 29, 2018
Version 7Show Document
  • View in full screen mode

Article Content

Article Number000035836
CVE IDCVE-2017-6168, CVE-2017-13098, CVE-2017-13099, CVE-2017-17382, CVE-2017-17427, CVE-2017-17428, CVE-2017-1000385
Article SummaryCERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products
ResolutionRSA is aware of the work of security researchers Hanno Böck, Juraj Somorovsky, and Craig Young to demonstrate variations of the 1998 Bleichenbacher attack on certain Transport Layer Security (TLS) implementation stacks.  (Also known as a "ROBOT attack")  RSA BSAFE® TLS implementation is not vulnerable to the attack demonstrated by the work of these researchers. 

RSA is investigating to identify RSA products that may use any of the impacted TLS implementation stacks. We will update this article with information as it becomes available, with impacted RSA products, if any, and remediation steps, if applicable.

Please note, the RSA keys referred to by CERT/CC VU#144389 have no relation to RSA the security company or the RSA SecurID® algorithm.
 
RSA Product NameVersionsImpacted?DetailsLast Updated
3D Secure / Adaptive Authentication eCommerce Not Impacted 2018-01-26
Access ManagerAll SupportedNot Impacted 2018-01-26
Adaptive Authentication Cloud Not ImpactedNo devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process.2018-02-19
Adaptive Authentication Hosted Not ImpactedNo devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process.2018-02-19
Adaptive Authentication On-Prem7.1.xNot Impacted 2018-02-19
Archer Hosted Not Impacted 2018-01-26
Archer PlatformAll SupportedNot Impacted 2018-01-26
Archer Security Operations Management (SecOps)All SupportedNot Impacted 2018-01-26
Archer Vulnerability & Risk Manager (VRM)All SupportedNot Impacted 2018-01-26
Authentication ManagerAll SupportedNot Impacted 2018-01-26
BSAFE C Products: MES, Crypto-C ME, SSL-CAll SupportedNot Impacted 2018-01-26
BSAFE Java Products: Cert-J, Crypto-J, SSL-JAll SupportedNot Impacted 2018-01-26
Data Loss Prevention    
Data Protection ManagerAll SupportedNot Impacted 2018-01-26
DCS: Certificate Manager6.9Not Impacted 2018-01-26
DCS: Validation Manager3.2Not Impacted 2018-01-26
eFraudNetwork (eFN) Not ImpactedThe reported issue is not applicable to the service.2018-02-22
Federated Identity ManagerAll SupportedNot Impacted 2018-01-26
FraudAction (OTMS)    
Identity Governance and Lifecycle (Software)All SupportedNot Impacted 2018-01-26
Identity Governance & Lifecycle (Appliance)All SupportedNot Impacted 2018-01-26
Identity Governance and Lifecycle SaaS / MyAccessLiveAll SupportedNot Impacted 2018-01-26
NetWitness Endpoint (ECAT)All SupportedImpacted - RemediatedThe product does not ship or include any of the impacted libraries, but relies on Erlang through RabbitMQ that customers download and install from 3rd party vendor site.  Erlang 20.2, which includes fixes for this issue, has been qualified with NetWitness Endpoint.2018-08-27
NetWitness Logs & Packets / Security AnalyticsAll SupportedImpactedRemediation plan in progress2018-01-30
NetWitness Live Infrastructure    
RSA Authentication Agent for Active Directory Federation ServicesAll SupportedNot Impacted 2018-01-30
RSA Authentication Agent for Citrix StoreFrontAll SupportedNot Impacted 2018-01-30
RSA Authentication Client (RAC)All SupportedNot Impacted 2018-01-30
RSA Central Not ImpactedThe reported issue is not applicable to the service.2018-02-19
SecurID Access Cloud Service    
SecurID Access IDR VM    
SecurID Agent for PAMAll SupportedNot Impacted 2018-01-30
SecurID Agent for WebAll SupportedNot Impacted 2018-01-30
SecurID Agent for WindowsAll SupportedNot Impacted 2018-01-30
SecurID Authenticate App for AndroidAll SupportedNot Impacted 2018-01-30
SecurID Authenticate App for iOSAll SupportedNot Impacted 2018-01-30
SecurID Authenticate App for Windows 10All SupportedNot Impacted 2018-01-30
SecurID Authentication EngineAll SupportedNot Impacted 2018-01-30
SecurID Authentication SDKAll SupportedNot Impacted 2018-01-30
SecurID Software Token ConverterAll SupportedNot Impacted 2018-01-30
SecurID Software Token for AndroidAll SupportedNot Impacted 2018-01-30
SecurID Software Token for BlackberryAll SupportedNot Impacted 2018-01-30
SecurID Software Token for DesktopAll SupportedNot Impacted 2018-01-30
SecurID Software Token for iPhoneAll SupportedNot Impacted 2018-01-30
SecurID Software Token for Windows MobileAll SupportedNot Impacted 2018-01-30
SecurID Software Token ToolbarAll SupportedNot Impacted 2018-01-30
SecurID Software Token Web SDKAll SupportedNot Impacted 2018-01-30
SecurID Transaction Signing SDKAll SupportedNot Impacted 2018-01-30
SYN Not ImpactedThe reported issue is not applicable to the service.2018-02-19
Web Threat DetectionAll SupportedNot Impacted 2018-02-19
NotesReferences:

 

Disclaimer

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Attachments

    Outcomes