Details of VAR-201404-0683

ID

VAR-201404-0683

CVE

CVE-2014-0636

TITLE

EMC RSA BSAFE Micro Edition Suite In SSL Vulnerability impersonating a server

Trust: 0.8

sources: JVNDB: JVNDB-2014-002004

DESCRIPTION

EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain. Successfully exploiting this issue allows attackers to create improper authenticated SSL connections, which will aid in further attacks. RSA BSAFE Micro Edition Suite (MES) 4.0.x versions prior to 4.0.5 and 3.2.x version prior to 3.2.6 are vulnerable. The toolkit helps developers achieve stable and secure application design. The vulnerability stems from the fact that the program does not properly validate the X.509 certificate chain. MES 4.0.5 and 3.2.6 are designed to address this issue by performing proper certificate validation. Recommendation: RSA strongly recommends that customers on MES 4.0.x upgrade to MES 4.0.5 and customers on MES 3.2.x upgrade to MES 3.2.6 at the earliest opportunity. Obtaining Downloads: To request your upgrade of the software, please call your local support telephone number (contact phone numbers are available at http://www.emc.com/support/rsa/contact/phone-numbers.htm) for most expedient service. Obtaining Documentation: To obtain RSA documentation, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com and click Products in the top navigation menu. Select the specific product whose documentation you want to obtain. Scroll to the section for the product version that you want and click the set link. Severity Rating: For an explanation of Severity Ratings, refer to the Knowledge Base Article, \x93Security Advisories Severity Rating\x94 at https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a46604. RSA recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. Obtaining More Information: For more information about RSA products, visit the RSA web site at http://www.rsa.com. Getting Support and Service: For customers with current maintenance contracts, contact your local RSA Customer Support center with any additional questions regarding this RSA SecurCare Note. For contact telephone numbers or e-mail addresses, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com, click Help & Contact, and then click the Contact Us - Phone tab or the Contact Us - Email tab. General Customer Support Information: http://www.emc.com/support/rsa/index.htm RSA SecurCare Online: https://knowledge.rsasecurity.com EOPS Policy: RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the link below for additional details. http://www.emc.com/support/rsa/eops/index.htm SecurCare Online Security Advisories RSA, The Security Division of EMC, distributes SCOL Security Advisories in order to bring to the attention of users of the affected RSA products important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaim all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. About RSA SecurCare Notes & Security Advisories Subscription RSA SecurCare Notes & Security Advisories are targeted e-mail messages that RSA sends you based on the RSA product family you currently use. If you\x92d like to stop receiving RSA SecurCare Notes & Security Advisories, or if you\x92d like to change which RSA product family Notes & Security Advisories you currently receive, log on to RSA SecurCare Online at https://knowledge.rsasecurity.com/scolcms/help.aspx?_v=view3. Following the instructions on the page, remove the check mark next to the RSA product family whose Notes & Security Advisories you no longer want to receive. Click the Submit button to save your selection. Sincerely, RSA Customer Support -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (Cygwin) iEYEARECAAYFAlNIFhUACgkQtjd2rKp+ALwepgCgtGh+srqAWqf0NedDF8AfS13Y 7FwAnRbX6vxIBBd4KBRVlKfYdj0CgMR2 =eaax -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2014-0636 // JVNDB: JVNDB-2014-002004 // BID: 66791 // VULHUB: VHN-68129 // PACKETSTORM: 126130

AFFECTED PRODUCTS

vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	4.0.2	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	3.2.0	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	3.2.4	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	4.0.3	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	4.0.4	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	4.0.0	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	3.2.2	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	3.2.3	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	4.0.1	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	3.2.1	Trust: 1.0
vendor:	dell	model:	bsafe micro-edition-suite	scope:	eq	version:	3.2.5	Trust: 1.0
vendor:	dell emc old emc	model:	rsa bsafe	scope:	lt	version:	4.0.x	Trust: 0.8
vendor:	hitachi	model:	ucosminexus service platform	scope:	eq	version:	(64)	Trust: 0.8
vendor:	dell emc old emc	model:	rsa bsafe	scope:	eq	version:	micro edition suite 3.2.6	Trust: 0.8
vendor:	hitachi	model:	ucosminexus application server	scope:	eq	version:	(64)	Trust: 0.8
vendor:	hitachi	model:	ucosminexus primary server	scope:	eq	version:	base	Trust: 0.8
vendor:	hitachi	model:	ucosminexus primary server	scope:	eq	version:	base(64)	Trust: 0.8
vendor:	hitachi	model:	ucosminexus service platform	scope:	eq	version:	none	Trust: 0.8
vendor:	hitachi	model:	ucosminexus developer	scope:	-	version:	-	Trust: 0.8
vendor:	dell emc old emc	model:	rsa bsafe	scope:	lt	version:	3.2.x	Trust: 0.8
vendor:	hitachi	model:	cosminexus http server	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	ucosminexus application server	scope:	eq	version:	none	Trust: 0.8
vendor:	hitachi	model:	ucosminexus application server	scope:	eq	version:	-r	Trust: 0.8
vendor:	dell emc old emc	model:	rsa bsafe	scope:	eq	version:	micro edition suite 4.0.5	Trust: 0.8
vendor:	hitachi	model:	ucosminexus service architect	scope:	-	version:	-	Trust: 0.8
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	3.2.3	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	3.2.5	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	3.2.4	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	3.2.1	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	4.0.3	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	4.0.4	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	3.2.0	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	3.2.2	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	4.0.1	Trust: 0.6
vendor:	emc	model:	rsa bsafe	scope:	eq	version:	4.0.0	Trust: 0.6

sources: JVNDB: JVNDB-2014-002004 // CNNVD: CNNVD-201404-161 // NVD: CVE-2014-0636

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-0636
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-0636
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201404-161
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-68129
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-0636
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-68129
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-68129 // JVNDB: JVNDB-2014-002004 // CNNVD: CNNVD-201404-161 // NVD: CVE-2014-0636

PROBLEMTYPE DATA

problemtype:

CWE-310

Trust: 1.9

sources: VULHUB: VHN-68129 // JVNDB: JVNDB-2014-002004 // NVD: CVE-2014-0636

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201404-161

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201404-161

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-002004

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-68129

PATCH

title:	RSA BSAFE Micro Edition Suite	url:	http://japan.emc.com/security/rsa-bsafe/rsa-bsafe-micro-edtion-suite.htm	Trust: 0.8
title:	HS14-012	url:	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-012/index.html	Trust: 0.8
title:	HS14-012	url:	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-012/index.html	Trust: 0.8
title:	EMC RSA BSAFE Micro Edition Suite Fixes for encryption problem vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=172323	Trust: 0.6

sources: JVNDB: JVNDB-2014-002004 // CNNVD: CNNVD-201404-161

EXTERNAL IDS

db:	NVD	id:	CVE-2014-0636	Trust: 2.9
db:	BID	id:	66791	Trust: 2.0
db:	JVNDB	id:	JVNDB-2014-002004	Trust: 0.8
db:	CNNVD	id:	CNNVD-201404-161	Trust: 0.7
db:	PACKETSTORM	id:	126130	Trust: 0.2
db:	VULHUB	id:	VHN-68129	Trust: 0.1

sources: VULHUB: VHN-68129 // BID: 66791 // JVNDB: JVNDB-2014-002004 // PACKETSTORM: 126130 // CNNVD: CNNVD-201404-161 // NVD: CVE-2014-0636

REFERENCES

url:	http://www.securityfocus.com/bid/66791	Trust: 1.7
url:	http://archives.neohapsis.com/archives/bugtraq/2014-04/0069.html	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0636	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0636	Trust: 0.8
url:	http://archives.neohapsis.com/archives/bugtraq/2014-04/att-0069/esa-2014-019.txt	Trust: 0.8
url:	http://www.emc.com/support/rsa/contact/phone-numbers.htm)	Trust: 0.1
url:	https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a46604.	Trust: 0.1
url:	http://www.emc.com/support/rsa/eops/index.htm	Trust: 0.1
url:	http://www.rsa.com.	Trust: 0.1
url:	https://knowledge.rsasecurity.com/scolcms/help.aspx?_v=view3.	Trust: 0.1
url:	https://knowledge.rsasecurity.com	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-0636	Trust: 0.1
url:	http://www.emc.com/support/rsa/index.htm	Trust: 0.1
url:	https://knowledge.rsasecurity.com,	Trust: 0.1

sources: VULHUB: VHN-68129 // JVNDB: JVNDB-2014-002004 // PACKETSTORM: 126130 // CNNVD: CNNVD-201404-161 // NVD: CVE-2014-0636

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 66791

SOURCES

db:	VULHUB	id:	VHN-68129
db:	BID	id:	66791
db:	JVNDB	id:	JVNDB-2014-002004
db:	PACKETSTORM	id:	126130
db:	CNNVD	id:	CNNVD-201404-161
db:	NVD	id:	CVE-2014-0636

LAST UPDATE DATE

2024-11-23T23:05:47.200000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-68129	date:	2021-12-09T00:00:00
db:	BID	id:	66791	date:	2015-01-12T00:03:00
db:	JVNDB	id:	JVNDB-2014-002004	date:	2014-05-16T00:00:00
db:	CNNVD	id:	CNNVD-201404-161	date:	2021-12-01T00:00:00
db:	NVD	id:	CVE-2014-0636	date:	2024-11-21T02:02:32.467

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-68129	date:	2014-04-11T00:00:00
db:	BID	id:	66791	date:	2014-04-11T00:00:00
db:	JVNDB	id:	JVNDB-2014-002004	date:	2014-04-16T00:00:00
db:	PACKETSTORM	id:	126130	date:	2014-04-11T20:22:22
db:	CNNVD	id:	CNNVD-201404-161	date:	2014-04-15T00:00:00
db:	NVD	id:	CVE-2014-0636	date:	2014-04-11T19:55:04.307