CVE-2014-0639

CVE-2014-0639 affects RSA Archer GRC 5.x, with fixes only in RSA Archer GRC 5.4 SP1 P3. The ESA-2014-021 advisory confirms multiple cross-site scripting vulnerabilities in RSA Archer GRC 5.4 SP1 P3 platform, allowing an attacker to execute arbitrary HTML/JavaScript in a user’s browser session wit...

CVE-2014-0639

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0643

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name...

Authentication flaw

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name...

CVE-2014-0643

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name...

CVE-2014-0643

CVE-2014-0643 affects EMC RSA NetWitness (before 9.8.5.19) and RSA Security Analytics (before 10.2.4 and before 10.3.2) where Kerberos PAM is enabled. The vulnerability allows remote attackers to bypass authentication by using a valid account name without a password, due to an authentication bypa...

OpenJDK: RSA unpadding timing issues (Security, 8027766)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security...

RSA NetWitness / RSA Security Analytics authentication bypass

Under some conditions, login with empty password is allowed...

ESA-2014-027: RSA® NetWitness and RSA® Security Analytics Authentication Bypass Vulnerability

ESA-2014-027.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-027: RSA® NetWitness and RSA® Security Analytics Authentication Bypass Vulnerability EMC Identifier: ESA-2014-027 CVE Identifier: CVE-2014-0643 Severity Rating: CVSS v2 Base Score: 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C Affected...

OpenJDK: RSA unpadding timing issues (Security, 8027766)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security...

NSA Reportedly Intercepts US-made Internet Routers to Install Spyware

The US Intelligence Agency, NSA has been reportedly intercepting and accessing routers, servers, and other computer networking hardware to plant data gathering “backdoors” and other spywares before they are exported and delivered to the international customers, reported by the Guardian. Yesterday...

Threatpost News Wrap, May 9, 2014

Dennis Fisher and Mike Mimoso discuss the major news stories of the last couple of weeks, including the proposal in TLS 1.3 to drop RSA key transport, the Snapchat FTC settlement and the end of Windows XP support. And no Heartbleed talk! Download: digitalunderground153.mp3 Music by Chris Gonsalve...

EMC RSA Access Manager Information Disclosure (ESA-2014-029)

The remote Windows host is running a version of EMC RSA Access Manager that is reportedly affected by an information disclosure vulnerability if the logging level is set to INFO. This could result in passwords being logged in plaintext. C Tenable Network Security, Inc. include"compat.inc"; if...

TLS 1.3 Has Consensus to Deprectate RSA Key Transport

The IETF working group responsible for the TLS 1.3 standard is closing in on a decision to remove RSA key transport cipher suites from the protocol. Decades-old RSA-based handshakes don’t cut it anymore, according to experts, who are anxious to put a modern protocol in place, one that can fend of...

EMC RSA BSAFE Micro Edition Suite security vulnerabilities

Few SSL related vulnerabilities in certificates chain validation and BEAST attacks...

ESA-2012-032: RSA BSAFE® Micro Edition Suite Security Update for BEAST (Browser Exploit Against SSL/TLS) attacks

ESA-2012-032.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-032: RSA BSAFE® Micro Edition Suite Security Update for BEAST Browser Exploit Against SSL/TLS attacks EMC Identifier: ESA-2012-032 CVE Identifier: CVE-2011-3389 Severity Rating: CVSS v2 Base Score: 4.3...

ESA-2014-003: RSA® Data Loss Prevention Improper Session Management Vulnerability

ESA-2014-003.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-003: RSA® Data Loss Prevention Improper Session Management Vulnerability EMC Identifier: ESA-2014-003 CVE Identifier: CVE-2014-0624 Severity Rating: CVSS v2 Base Score: 3.5 AV:L/AC:H/Au:S/C:P/I:P/A:P Affected Products: RSA Da...

EMC RSA Data Loss Prevention privilege escalation

Privilege escalation because of invalid session management...

ESA-2014-019: RSA BSAFE® Micro Edition Suite Certificate Chain Processing Vulnerability

ESA-2014-019.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-019: RSA BSAFE® Micro Edition Suite Certificate Chain Processing Vulnerability EMC Identifier: ESA-2014-019 CVE Identifier: CVE-2014-0636 Severity Rating: CVSS v2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected Products:...

Ruby OpenSSL CA private key forgery vulnerability-vulnerability warning-the black bar safety net

The Ruby OpenSSL CA private key forgery vulnerability require ‘rubygems’ require ‘openssl’ require 'digest/md5' key = OpenSSL::PKey::RSA. new2 0 4 8 cipher = OpenSSL::Cipher::AES. new2 5 6, :CBC ctx = OpenSSL::SSL::SSLContext. new puts “Spoof must be in DER format and saved as root. cer” raw =...