RSA AuthSDK C with AM 8.0 - ACM_OK (Passcode Accepted) returned inappropriately when passode field contains 257 or more characters.
Originally Published: 2014-01-17
Last Modified: 2023-09-22
Article Number
000052693
Applies To
RSA AuthSDK 8.1 Patch 2
Issue
RSA AuthSDK for user authentication.

Customer was not following our sample code and was able to enter a passcode of 257 random characters. They then found that when they called AceGetAuthenticationStatus it returned the response ACM_OK, indicating passcode accepted. If this were true this could be considered a vulnerability.

Cause
Customer failed to follow our sample code and coded incorrectly. First they failed to set a maximum field length for the passcode field with _passcode.Length, thus allowing more than the 256 characters for the passcode field. Regardless or that fact they then called AceGetAuthenticationStatus inappropriately. They ignored the more.Flag set in AceContinueAuth which indicated there was more data requested and the authentication was not complete. The ACM_OK returned at that time was correct but calling AceGetAuthenticationStatus at that time was not.

Resolution
Customers should follow sample code. If coded properly the end result would have been ACM_ACCESS_DENIED. RSA does not consider this to be a security vulnerability since it was due to improper coding for the authentication agent they were writing.

Related Articles

Trending Articles

Don't see what you're looking for?