PT-2011-4859

Name of the Vulnerable Software and Affected Versions EMC RSA SecurID Software Token version 4.1 Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory. This can be demonstrated by a directory that contains a Software Token file, where...

KLA10304 LPE vulnerability in RSA SecurID Software Token

An untrusted path vulnerability was found in the RSA SecurID Software Token. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally via a DLL hijack. Original advisories - Exploitation Related products RSA-SecurID-Software-Token CVE list...

What About Fob?

Few things sent shockwaves to all corners of the security community like news in March that RSA’s popular SecurID two-factor authentication tokens had been rendered all but useless by a small but cleverly targeted phishing campaign that included a payload of a malicious Flash object embedded in a...

CVE-2011-2741

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a 1 previously non-registered device or...

CVE-2011-2742

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile...

Design/Logic Flaw

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a 1 previously non-registered device or...

Design/Logic Flaw

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile...

CVE-2011-2741

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a 1 previously non-registered device or...

CVE-2011-2742

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile...

CVE-2011-2742

Summary: CVE-2011-2742 affects EMC RSA Adaptive Authentication On-Premise (AAOP). The issue is that AAOP 6.0.2.1 SP1 Patch 2/3, SP2/SP2 Patch 1, and SP3 does not perform forensic evaluation when device tokens are received from mobile apps, potentially allowing a mobile device to bypass applicatio...

CVE-2011-2741

CVE-2011-2741 affects EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2/3, SP2/SP2 Patch1, and SP3. The issue concerns Device Recovery and Device Identification, where certain data elements from end-user devices may allow bypassing security restrictions for both previously non...

PT-2011-4054

Name of the Vulnerable Software and Affected Versions EMC RSA Adaptive Authentication On-Premise AAOP versions 6.0.2.1 SP1 Patch 2 through 6.0.2.1 SP3 Description The issue is related to the improper performance of forensic evaluation upon receipt of device tokens from mobile apps. This might all...

CVE-2011-2742: Undefined Security Weakness

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile...

CVE-2011-2741: Undefined Security Weakness

EMC RSA Adaptive Authentication On-Premise AAOP 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a 1 previously non-registered device or...

PT-2011-4053

Name of the Vulnerable Software and Affected Versions EMC RSA Adaptive Authentication On-Premise AAOP versions 6.0.2.1 SP1 Patch 2 through 6.0.2.1 SP3 Description The issue is related to the improper implementation of Device Recovery and Device Identification. This might allow remote attackers to...

SuSE 10 Security Update : mozilla-nss (ZYPP Patch Number 7842) (BEAST)

This update to version 3.13.1 of mozilla-nss fixes the following issues : - Explicitly distrust DigiCert Sdn. Bhd bmo698753 - Better SHA-224 support bmo647706 - Fix a regression causing hangs in some situations introduced in 3.13 bmo693228 - SSL 2.0 is disabled by default - A defense against the...

Insecure RSA Encryption in jCryption, PEAR Crypt_RSA and Crypt_RSA2

SWITCH-CERT SECURITY ADVISORY ============================= Vulnerability: Insecure Implementation of RSA Encryption Affected Products: jCryption, PEAR CryptRSA, PEAR CryptRSA2 Advisory Date: 2011-11-30 Advisory Author: Daniel Roethlisberger, SWITCH-CERT Introduction Web applications using...

CVE-2011-2740

EMC RSA Key Manager RKM Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation...

CVE-2011-2740

CVE-2011-2740 affects EMC RSA Key Manager Appliance 2.7 SP1 prior to 2.7.1.6. When using Firefox 4.x or 5.0, it does not properly terminate a user session on logout, enabling potential remote code execution via an unattended workstation. The NVD lists a high CVSSv2 base score (9.3) with network a...

CVE-2011-2740

EMC RSA Key Manager RKM Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation...