ESA-2013-050: EMC Replication Manager Sensitive Information Disclosure Vulnerability

ESA-2013-050.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-050: EMC Replication Manager Sensitive Information Disclosure Vulnerability EMC Identifier: ESA-2013-050 CVE Identifier: CVE-2013-3272 Severity Rating: CVSS v2 Base Score: 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C Affected products: EMC...

EMC RSA BSAFE multiple security vulnerabilities

SSL-related attacks...

CVE-2013-3272

EMC Replication Manager RM before 5.4.4 places encoded passwords in application log files, which makes it easier for local users to obtain sensitive information by reading a file and conducting an unspecified decoding attack...

CVE-2013-3273

EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log file...

Design/Logic Flaw

EMC Replication Manager RM before 5.4.4 places encoded passwords in application log files, which makes it easier for local users to obtain sensitive information by reading a file and conducting an unspecified decoding attack...

CVE-2013-3272

EMC Replication Manager (RM) prior to version 5.4.4 logs encoded passwords in application log files, enabling local users to read sensitive credentials. Affected product: EMC Replication Manager (RM) before 5.4.4. Remediation: upgrade to RM 5.4.4; delete relevant server log files and reset expose...

CVE-2013-3273

Vulnerability CVE-2013-3273 affects RSA Authentication Manager 8.0 prior to Patch 2 and 7.1 prior to Service Pack 4 Patch 26 (including Appliance 3.0). The issue is that when using the SDK to develop custom applications and with trace logging set to verbose, the administrative account password ca...

CVE-2013-3272

EMC Replication Manager RM before 5.4.4 places encoded passwords in application log files, which makes it easier for local users to obtain sensitive information by reading a file and conducting an unspecified decoding attack...

CVE-2013-3273

EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log file...

CVE-2013-0947

EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP communities by reading a 1 log file or 2 configuration file...

Design/Logic Flaw

EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP communities by reading a 1 log file or 2 configuration file...

CVE-2013-0947

EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP communities by reading a 1 log file or 2 configuration file...

CVE-2013-0947

CVE-2013-0947 affects RSA Authentication Manager 8.0 before Patch 1 (P1). Vulnerability: local users can read cleartext passwords stored in logs or configuration files (operating-system, HTTP plug-in proxy passwords, SNMP communities). This is an information-disclosure weakness in log and config ...

ESA-2013-040: RSA® Authentication Manager 8.0 Multiple Vulnerabilities

ESA-2013-040.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-040: RSA® Authentication Manager 8.0 Multiple Vulnerabilities EMC Identifier: ESA-2013-040 CVE Identifier: CVE-2013-0947, CVE-2013-1899 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: R...

EMC AlphaStor Library Control Program Multiple Buffer Overflows (CVE-2013-0946)

Multiple buffer overflow vulnerabilities has been reported in EMC AlphaStor Library Control Program LCP while parsing remote requests. The vulnerabilities are due to missing bounds check while copying request data into fixed length stack buffers. An unauthenticated attackers can exploit this...

CVE-2013-0942

Cross-site scripting XSS vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0941

EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the no...

Input validation

EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the no...

Cross site scripting

Cross-site scripting XSS vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0941

CVE-2013-0941 affects RSA/SecurID components. The node secret in affected products is stored using a dated encryption algorithm with a weak key, exposing confidentiality and integrity risk for local communications between RSA/Access Manager components. Affected: RSA Authentication API up to 8.1 S...