CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products
2 years ago
Originally Published: 2017-12-12
Article Number
000067217
CVE Identifier(s)
CVE-2017-6168, CVE-2017-13098, CVE-2017-13099, CVE-2017-17382, CVE-2017-17427, CVE-2017-17428, CVE-2017-1000385
Article Summary
CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products
Resolution
RSA is aware of the work of security researchers Hanno Böck, Juraj Somorovsky, and Craig Young to demonstrate variations of the 1998 Bleichenbacher attack on certain Transport Layer Security (TLS) implementation stacks (also known as a "ROBOT attack").  RSA BSAFE® TLS implementation is not vulnerable to the attack demonstrated by the work of these researchers. 

RSA is investigating to identify RSA products that may use any of the impacted TLS implementation stacks. We will update this article with information as it becomes available, with impacted RSA products, if any, and remediation steps, if applicable.

Please note:  The RSA keys referred to by CERT/CC VU#144389 have no relation to RSA the security company or the RSA SecurID® algorithm.
 
RSA Product NameVersionsImpacted?DetailsLast Updated
3D Secure (RSA Adaptive Authentication eCommerce) Not Impacted 2018-01-26
RSA Access ManagerAll SupportedNot Impacted 2018-01-26
RSA Adaptive Authentication Cloud Not ImpactedNo devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process.2018-02-19
RSA Adaptive Authentication Hosted Not ImpactedNo devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process.2018-02-19
RSA Adaptive Authentication On-Prem7.1.xNot Impacted 2018-02-19
RSA Archer Hosted Not Impacted 2018-01-26
RSA Archer PlatformAll SupportedNot Impacted 2018-01-26
RSA Archer Security Operations Management (SecOps)All SupportedNot Impacted 2018-01-26
RSA Archer Vulnerability & Risk Manager (VRM)All SupportedNot Impacted 2018-01-26
RSA Authentication ManagerAll SupportedNot Impacted 2018-01-26
RSA BSAFE C Products: MES, Crypto-C ME, SSL-CAll SupportedNot Impacted 2018-01-26
RSA BSAFE Java Products: Cert-J, Crypto-J, SSL-JAll SupportedNot Impacted 2018-01-26
RSA Data Loss Prevention    
RSA Data Protection ManagerAll SupportedNot Impacted 2018-01-26
RSA Digital Certificate Solutions: Certificate Manager6.9Not Impacted 2018-01-26
RSA Digital Certificate Solutions: Validation Manager3.2Not Impacted 2018-01-26
RSA eFraudNetwork (eFN) Not ImpactedThe reported issue is not applicable to the service.2018-02-22
RSA Federated Identity ManagerAll SupportedNot Impacted 2018-01-26
RSA FraudAction (OTMS)    
RSA Identity Governance & Lifecycle (Software)All SupportedNot Impacted 2018-01-26
RSA Identity Governance & Lifecycle (Appliance)All SupportedNot Impacted 2018-01-26
RSA Identity Governance & Lifecycle SaaS/MyAccessLive (MAL)All SupportedNot Impacted 2018-01-26
RSA NetWitness Endpoint (ECAT)All SupportedImpacted - RemediatedThe product does not ship or include any of the impacted libraries, but relies on Erlang through RabbitMQ that customers download and install from 3rd party vendor site.  Erlang 20.2, which includes fixes for this issue, has been qualified with NetWitness Endpoint.2018-08-27
RSA NetWitness Logs & Packets/Security AnalyticsAll SupportedImpacted - RemediatedErlang has been updated to version 20.3 in RSA NetWitness 11.2.1.  See RSA NetWitness Platform 11.2.1 Release Notes.2019-06-10
RSA NetWitness Live Infrastructure    
RSA Authentication Agent for Active Directory Federation ServicesAll SupportedNot Impacted 2018-01-30
RSA Authentication Agent for Citrix StoreFrontAll SupportedNot Impacted 2018-01-30
RSA Authentication Client (RAC)All SupportedNot Impacted 2018-01-30
RSA Central Not ImpactedThe reported issue is not applicable to the service.2018-02-19
RSA SecurID Access Cloud Service    
RSA SecurID Access Identity Router (IDR) VM    
RSA SecurID Agent for PAMAll SupportedNot Impacted 2018-01-30
RSA SecurID Agent for WebAll SupportedNot Impacted 2018-01-30
RSA SecurID Agent for WindowsAll SupportedNot Impacted 2018-01-30
RSA SecurID Authenticate App for AndroidAll SupportedNot Impacted 2018-01-30
RSA SecurID Authenticate App for iOSAll SupportedNot Impacted 2018-01-30
RSA SecurID Authenticate App for Windows 10All SupportedNot Impacted 2018-01-30
RSA SecurID Authentication EngineAll SupportedNot Impacted 2018-01-30
RSA SecurID Authentication SDKAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token ConverterAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token for AndroidAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token for BlackBerryAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token for Windows DesktopAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token for iPhoneAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token for Windows MobileAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token ToolbarAll SupportedNot Impacted 2018-01-30
RSA SecurID Software Token Web SDKAll SupportedNot Impacted 2018-01-30
RSA SecurID Transaction Signing SDKAll SupportedNot Impacted 2018-01-30
SYN Not ImpactedThe reported issue is not applicable to the service.2018-02-19
RSA Web Threat DetectionAll SupportedNot Impacted 2018-02-19
Notes
References:
Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Related Articles

Trending Articles

Don't see what you're looking for?