CVE-2016-8212

An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpda...

CVE-2016-8217

Technical details for CVE-2016-8217 are not publicly available in the provided documents. Monitor for updates from vendor advisories and trusted CVE sources.

CVE-2016-8212

EMC RSA BSAFE Crypto-J v6.2.2+ fixes CVE-2016-8212. The issue is an OCSP validation flaw: Crypto-J treats OCSP responses with no nextUpdate as valid indefinitely, instead of limiting validity around thisUpdate. This can allow using certificates whose revocation status is not properly constrained....

CVE-2016-8217

EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS12 file to the toolkit and...

EMC RSA BSAFE Micro Edition Suite TLS Man-in-the-Middle Attack Vulnerability

EMC RSA BSAFE Micro Edition Suite MES is an encryption toolkit from EMC Corporation. The toolkit helps developers achieve stable and secure application design.TLS Transport Layer Security is a set of protocols used to provide confidentiality and data integrity between two communicating...

CVE-2016-0923

The client in EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server...

Code injection

The client in EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server...

CVE-2016-0923

CVE-2016-0923 affects the EMC RSA BSAFE Micro Edition Suite (MES) client. The vulnerability is that MES 4.0.x (before 4.0.9) and 4.1.x (before 4.1.5) places the weakest signature algorithms first in the signature-algorithm list sent to the server, enabling a remote attacker to defeat cryptographi...

CVE-2016-0923

The client in EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server...

CVE-2016-0887

EMC RSA BSAFE Micro Edition Suite MES 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition CCME 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by...

Session fixation

EMC RSA BSAFE Micro Edition Suite MES 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition CCME 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by...

CVE-2016-0887

EMC RSA BSAFE Micro Edition Suite MES 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition CCME 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by...

CVE-2016-0887

The CVE-2016-0887 entry concerns EMC RSA BSAFE products: MES 4.0.x and 4.1.x before 4.1.5, CCME 4.0.x and 4.1.x before 4.1.3, Crypto-J before 6.2.1, SSL-J before 6.2.1, and SSL-C before 2.8.9. A Lenstra side-channel attack can be conducted when an application fails to detect an RSA signature fail...

Multiple EMC RSA Products ESA-2015-081 Multiple Security Vulnerabilities

受影响的产品： RSA BSAFE Micro Edition Suite MES all 4.1.x versions prior to 4.1.3 RSA BSAFE Micro Edition Suite MES all 4.0.x versions prior to 4.0.8 RSA BSAFE Crypto-C Micro Edition Crypto-C ME 4.1 RSA BSAFE Crypto-C Micro Edition Crypto-C ME all versions prior to 4.0.4 RSA BSAFE Crypto-J all versions...

EMC RSA BSAFE multiple security vulnerabilities

Integer overflow in base64 decode, multiple crypto vulnerabilities...

ESA-2015-081: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-081: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities EMC Identifier: ESA-2015-081 CVE Identifier: CVE-2015-0533, CVE-2015-0534, CVE-2015-0535, CVE-2015-0536, CVE-2015-0537 Severity...

CVE-2015-0537

Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition Crypto-C ME before 4.0.4 and 4.1, and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to cause a denial of service...

CVE-2015-0536

EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service daemon crash via a ClientKeyExchange messa...

CVE-2015-0535

EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier do not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, relate...

CVE-2015-0534

EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL-C 2.8.9 and earlier do not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based...