000036372 - Microprocessor Side-Channel Vulnerabilities (CVE-2018-3639 and CVE-2018-3640): Impact on RSA products

Document created by RSA Customer Support Employee on May 21, 2018Last modified by RSA Customer Support Employee on Oct 4, 2018
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000036372
CVE IDCVE-2018-3639, CVE-2018-3640
Article SummaryRSA is aware of the side-channel vulnerabilities known as Speculative Store Bypass (CVE-2018-3639) and Rogue System Register Read (CVE-2018-3640) affecting many modern microprocessors that were published by researchers from Microsoft Security Response Center (MSRC) and Google Project Zero on 21 May 2018. An unprivileged attacker with local user access to the system could potentially exploit these vulnerabilities to read privileged memory data. For more information, please review security updates posted by Intel.
 
RSA is investigating the impact of these issues on our products. We will update this article regularly with impact details and mitigation steps as they become available. Mitigation steps may vary by product and may require updates to processor microcode (BIOS), Operating System (OS), Virtual Machine Manager (VMM), and other software components.
 
RSA recommends customers follow security best practices for malware protection to help prevent possible exploitation of these vulnerabilities until any future updates can be applied. These practices include, but are not limited to, promptly deploying software updates, avoiding unknown hyperlinks and websites, never downloading files or applications from unknown sources, and employing up-to-date anti-virus and advanced threat protection solutions.
 
For information on other Dell products, please see http://dell.com/support/speculative-store-bypass.
Link to Advisories
Resolution 
RSA Product NameVersionsImpact StatusDetailsLast Updated
3D Secure / Adaptive Authentication eCommerceCurrent Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
Access Manager6.2No direct impactSee Note 1.2018-05-21
Adaptive Authentication CloudCurrent Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
Adaptive Authentication HostedCurrent Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
Adaptive Authentication On-PremAll SupportedNo direct impactSee Note 1.2018-05-21
Archer Hosted (US)Current Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
Archer Hosted (EMEA)Current Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
Archer PlatformAll SupportedNo direct impactSee Note 1.2018-05-21
Archer Security Operations Management (SecOps)All SupportedNo direct impactSee Note 1.2018-05-21
Archer Vulnerability & Risk Manager (VRM) - Hardware ApplianceAll SupportedNo additional security riskSee Note 3.2018-05-21
Archer Vulnerability & Risk Manager (VRM) - Virtual ApplianceAll SupportedNo additional security riskSee Note 3.
   Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.
2018-05-21
Authentication Manager (Hardware Appliance - Dell PowerEdge & Intel platforms)All SupportedNo additional security riskSee Note 3.2018-05-21
Authentication Manager (Virtual Appliance)All SupportedNo additional security riskSee Note 3.
   Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.
2018-05-21
Authentication Manager Web TierAll SupportedNo direct impactSee Note 1.2018-05-21
BSAFE C Products: MES, Crypto-C ME, SSL-CAll SupportedNo direct impactSee Note 1.2018-05-21
BSAFE Java Products: Cert-J, Crypto-J, SSL-JAll SupportedNo direct impactSee Note 1.2018-05-21
Data Loss Prevention (Hardware Appliance)All SupportedImpactedRemediation plan in progress.2018-05-21
Data Loss Prevention (Virtual Appliance)All SupportedImpactedRemediation plan in progress. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.2018-05-21
Data Protection Manager (Software)All SupportedNo direct impactSee Note 1.2018-05-21
Data Protection Manager (Hardware Appliance)All SupportedImpacted - RemediatedRSA Data Protection Manager 3.5.2.7 contains resolution for this issue. For more details, refer to the security advisory DSA-2018-189.2018-10-02
Data Protection Manager (Virtual Appliance)All SupportedImpacted - RemediatedRSA Data Protection Manager 3.5.2.7 contains resolution for this issue. For more details, refer to the security advisory DSA-2018-189.
   Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.
2018-10-02
DCS: Certificate Manager6.9No direct impactSee Note 1.2018-05-21
DCS: Validation Manager3.2No direct impactSee Note 1.2018-05-21
eFraudNetwork (eFN)Current Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
enVisionEOL The product has reached End of Life. Please refer to the Product Version Life Cycle for RSA enVision page on RSA Link.2018-05-21
Federated Identity Manager4.2No direct impactSee Note 1.2018-05-21
FraudAction (OTMS)Current Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
Identity Governance & Lifecycle (Software),
   Via Lifecycle & Governance (Software),
   Identity Management & Governance (Software)
7.1, 7.0.2, 7.0.1, 7.0, 6.9.1, 6.9.0No direct impactSee Note 1.2018-05-21
Identity Governance & Lifecycle (Hardware Appliance),
   Via Lifecycle & Governance (Hardware Appliance),
   Identity Management & Governance (Hardware Appliance)
7.1, 7.0.2, 7.0.1, 7.0, 6.9.1, 6.9.0Impacted - RemediatedRefer to the security advisory DSA-2018-179 for OS and BIOS updates.
  
   Any Remote Agents or Remote AFX deployed in customer environment are a software product only and have no direct impact. See Note 1.
2018-09-25
Identity Governance & Lifecycle (Virtual Application)7.1Impacted - RemediatedRefer to the security advisory DSA-2018-179 for OS updates. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.
  
   Any Remote Agents or Remote AFX deployed in customer environment are a software product only and have no direct impact. See Note 1.
2018-09-25
Identity Governance & Lifecycle SaaS / MyAccessLive Under investigationAny Remote Agents or Remote AFX deployed in customer environment are a software product only and have no direct impact. See Note 1.2018-05-21
NetWitness Endpoint (ECAT)All SupportedNo direct impactSee Note 1.2018-05-21
NetWitness Logs & Packets / Security Analytics
   (Hardware Appliance)
All SupportedNo additional security riskSee Note 3.2018-05-21
NetWitness Logs & Packets / Security Analytics
   (Virtual Appliance)
All SupportedNo additional security riskSee Note 3.
   Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.
2018-05-21
NetWitness Logs & Packets / Security Analytics - Legacy Windows CollectorAll SupportedNo direct impactSee Note 1.2018-05-21
NetWitness Live InfrastructureCurrent Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
RSA Authentication Client (RAC)All SupportedNo direct impactSee Note 1.2018-05-21
RSA CentralCurrent Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
SecurID Access Cloud ServiceCurrent Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
SecurID Access IDR VMAll SupportedNo additional security riskSee Note 2.
   Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.
2018-05-21
SecurID Agent for PAMAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Agent for WebAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Agent for WindowsAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Authenticate App for AndroidAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Authenticate App for iOSAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Authenticate App for Windows 10All SupportedNo direct impactSee Note 1.2018-05-21
SecurID Authentication EngineAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Authentication SDKAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token ConverterAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token for AndroidAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token for BlackberryAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token for DesktopAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token for iPhoneAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token for Windows MobileAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token ToolbarAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Software Token Web SDKAll SupportedNo direct impactSee Note 1.2018-05-21
SecurID Transaction Signing SDKAll SupportedNo direct impactSee Note 1.2018-05-21
SYNCurrent Hosted EnvironmentNo additional security riskSee Note 2.2018-05-30
Web Threat DetectionAll SupportedNo direct impactSee Note 1.2018-05-21


Note 1: It is a software product only. Reported vulnerabilities are best mitigated via firmware and operating system updates. Customers are strongly advised to patch their host systems where the product is installed.

Note 2: To take advantage of these vulnerabilities, an attacker first must be able to run malicious code on the targeted system. The product is designed to prevent users from loading and executing any external and/or untrusted code on the system. The reported issues do not introduce any additional security risk to the product.

Note 3: To take advantage of these vulnerabilities, an attacker first must be able to run malicious code on the targeted system. Access to the product to load external and/or potentially untrusted code is restricted to users with root or root-equivalent privileges only. The reported issues do not introduce any additional security risk to the product, provided the recommended best practices to protect the access of highly privileged account are followed.
NotesFor information on other Dell products, please see http://dell.com/support/speculative-store-bypass.

 

Disclaimer

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell EMC, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Attachments

    Outcomes