CVE-2018-11069

RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securitytracker.com/id/1041614	Third Party Advisory VDB Entry
https://seclists.org/fulldisclosure/2018/Sep/7	Mailing List Third Party Advisory
http://www.securitytracker.com/id/1041614	Third Party Advisory VDB Entry
https://seclists.org/fulldisclosure/2018/Sep/7	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:bsafe_ssl-j:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:42

Type	Values Removed	Values Added
References	~~() http://www.securitytracker.com/id/1041614 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1041614 - Third Party Advisory, VDB Entry
References	~~() https://seclists.org/fulldisclosure/2018/Sep/7 - Mailing List, Third Party Advisory~~	() https://seclists.org/fulldisclosure/2018/Sep/7 - Mailing List, Third Party Advisory

Information

Published : 2018-09-11 19:29

Updated : 2024-11-21 03:42

NVD link : CVE-2018-11069

Mitre link : CVE-2018-11069

CVE.ORG link : CVE-2018-11069

JSON object : View

Products Affected

dell

bsafe_ssl-j

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2018-11069", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2018-09-11T19:29:01.270", "references": [{"url": "http://www.securitytracker.com/id/1041614", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "https://seclists.org/fulldisclosure/2018/Sep/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "security_alert@emc.com"}, {"url": "http://www.securitytracker.com/id/1041614", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/fulldisclosure/2018/Sep/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decryption. A remote attacker may be able to recover a RSA key."}, {"lang": "es", "value": "RSA BSAFE SSL-J, en versiones anteriores a la 6.2.4 contiene una vulnerabilidad de canal de tiempo oculto durante el descifrado RSA. Esto tambi\u00e9n se conoce como ataque Bleichenbacher sobre descifrado RSA. Un atacante remoto podr\u00eda ser capaz de recuperar una clave RSA."}], "lastModified": "2024-11-21T03:42:37.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:bsafe_ssl-j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86697545-1BE7-457C-9AE9-B5270C531D49", "versionEndExcluding": "6.2.4"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}