This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Security Advisory Articles
- RSA Community
- :
- Support
- :
- Security Advisory Articles
- :
- CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products
-
Options
- Subscribe to RSS Feed
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products
Article Number
000035836
CVE ID
CVE-2017-6168, CVE-2017-13098, CVE-2017-13099, CVE-2017-17382, CVE-2017-17427, CVE-2017-17428, CVE-2017-1000385
Article Summary
CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products
Resolution
RSA is aware of the work of security researchers Hanno Böck, Juraj Somorovsky, and Craig Young to demonstrate variations of the 1998 Bleichenbacher attack on certain Transport Layer Security (TLS) implementation stacks (also known as a "ROBOT attack"). RSA BSAFE® TLS implementation is not vulnerable to the attack demonstrated by the work of these researchers.
RSA is investigating to identify RSA products that may use any of the impacted TLS implementation stacks. We will update this article with information as it becomes available, with impacted RSA products, if any, and remediation steps, if applicable.
Please note: The RSA keys referred to by CERT/CC VU#144389 have no relation to RSA the security company or the RSA SecurID® algorithm.
RSA is investigating to identify RSA products that may use any of the impacted TLS implementation stacks. We will update this article with information as it becomes available, with impacted RSA products, if any, and remediation steps, if applicable.
Please note: The RSA keys referred to by CERT/CC VU#144389 have no relation to RSA the security company or the RSA SecurID® algorithm.
| RSA Product Name | Versions | Impacted? | Details | Last Updated |
|---|---|---|---|---|
| 3D Secure (RSA Adaptive Authentication eCommerce) | Not Impacted | 2018-01-26 | ||
| RSA Access Manager | All Supported | Not Impacted | 2018-01-26 | |
| RSA Adaptive Authentication Cloud | Not Impacted | No devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process. | 2018-02-19 | |
| RSA Adaptive Authentication Hosted | Not Impacted | No devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process. | 2018-02-19 | |
| RSA Adaptive Authentication On-Prem | 7.1.x | Not Impacted | 2018-02-19 | |
| RSA Archer Hosted | Not Impacted | 2018-01-26 | ||
| RSA Archer Platform | All Supported | Not Impacted | 2018-01-26 | |
| RSA Archer Security Operations Management (SecOps) | All Supported | Not Impacted | 2018-01-26 | |
| RSA Archer Vulnerability & Risk Manager (VRM) | All Supported | Not Impacted | 2018-01-26 | |
| RSA Authentication Manager | All Supported | Not Impacted | 2018-01-26 | |
| RSA BSAFE C Products: MES, Crypto-C ME, SSL-C | All Supported | Not Impacted | 2018-01-26 | |
| RSA BSAFE Java Products: Cert-J, Crypto-J, SSL-J | All Supported | Not Impacted | 2018-01-26 | |
| RSA Data Loss Prevention | ||||
| RSA Data Protection Manager | All Supported | Not Impacted | 2018-01-26 | |
| RSA Digital Certificate Solutions: Certificate Manager | 6.9 | Not Impacted | 2018-01-26 | |
| RSA Digital Certificate Solutions: Validation Manager | 3.2 | Not Impacted | 2018-01-26 | |
| RSA eFraudNetwork (eFN) | Not Impacted | The reported issue is not applicable to the service. | 2018-02-22 | |
| RSA Federated Identity Manager | All Supported | Not Impacted | 2018-01-26 | |
| RSA FraudAction (OTMS) | ||||
| RSA Identity Governance & Lifecycle (Software) | All Supported | Not Impacted | 2018-01-26 | |
| RSA Identity Governance & Lifecycle (Appliance) | All Supported | Not Impacted | 2018-01-26 | |
| RSA Identity Governance & Lifecycle SaaS/MyAccessLive (MAL) | All Supported | Not Impacted | 2018-01-26 | |
| RSA NetWitness Endpoint (ECAT) | All Supported | Impacted - Remediated | The product does not ship or include any of the impacted libraries, but relies on Erlang through RabbitMQ that customers download and install from 3rd party vendor site. Erlang 20.2, which includes fixes for this issue, has been qualified with NetWitness Endpoint. | 2018-08-27 |
| RSA NetWitness Logs & Packets/Security Analytics | All Supported | Impacted - Remediated | Erlang has been updated to version 20.3 in RSA NetWitness 11.2.1. See RSA NetWitness Platform 11.2.1 Release Notes. | 2019-06-10 |
| RSA NetWitness Live Infrastructure | ||||
| RSA Authentication Agent for Active Directory Federation Services | All Supported | Not Impacted | 2018-01-30 | |
| RSA Authentication Agent for Citrix StoreFront | All Supported | Not Impacted | 2018-01-30 | |
| RSA Authentication Client (RAC) | All Supported | Not Impacted | 2018-01-30 | |
| RSA Central | Not Impacted | The reported issue is not applicable to the service. | 2018-02-19 | |
| RSA SecurID Access Cloud Service | ||||
| RSA SecurID Access Identity Router (IDR) VM | ||||
| RSA SecurID Agent for PAM | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Agent for Web | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Agent for Windows | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Authenticate App for Android | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Authenticate App for iOS | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Authenticate App for Windows 10 | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Authentication Engine | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Authentication SDK | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token Converter | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token for Android | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token for BlackBerry | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token for Windows Desktop | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token for iPhone | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token for Windows Mobile | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token Toolbar | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Software Token Web SDK | All Supported | Not Impacted | 2018-01-30 | |
| RSA SecurID Transaction Signing SDK | All Supported | Not Impacted | 2018-01-30 | |
| SYN | Not Impacted | The reported issue is not applicable to the service. | 2018-02-19 | |
| RSA Web Threat Detection | All Supported | Not Impacted | 2018-02-19 |
Notes
References:
- CERT/CC Vulnerability Note: http://www.kb.cert.org/vuls/id/144389
- Researcher's website: https://robotattack.org/
Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
No ratings
