CVE-2013-2052

CVE-2013-2052 describes a remote, non-authenticated buffer overflow in the atodn() function of Libreswan/OpenSwan when Opportunistic Encryption is enabled and an attacker controls a DNS TXT PTR record. This can crash the pluto IKE daemon and potentially allow code execution. The vulnerability is ...

CVE-2013-2053

Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service pluto IKE daemon crash and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be...

CVE-2013-3273

EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log file...

Design/Logic Flaw

EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log file...

CVE-2013-3273

Vulnerability CVE-2013-3273 affects RSA Authentication Manager 8.0 prior to Patch 2 and 7.1 prior to Service Pack 4 Patch 26 (including Appliance 3.0). The issue is that when using the SDK to develop custom applications and with trace logging set to verbose, the administrative account password ca...

CVE-2013-3273

EMC RSA Authentication Manager 8.0 before P2 and 7.1 before SP4 P26, as used in Appliance 3.0, does not omit the cleartext administrative password from trace logging in custom SDK applications, which allows local users to obtain sensitive information by reading the trace log file...

CVE-2013-0947

EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP communities by reading a 1 log file or 2 configuration file...

Design/Logic Flaw

EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP communities by reading a 1 log file or 2 configuration file...

CVE-2013-0947

CVE-2013-0947 affects RSA Authentication Manager 8.0 before Patch 1 (P1). Vulnerability: local users can read cleartext passwords stored in logs or configuration files (operating-system, HTTP plug-in proxy passwords, SNMP communities). This is an information-disclosure weakness in log and config ...

CVE-2013-0947

EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP communities by reading a 1 log file or 2 configuration file...

ESA-2013-040: RSA® Authentication Manager 8.0 Multiple Vulnerabilities

ESA-2013-040.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-040: RSA® Authentication Manager 8.0 Multiple Vulnerabilities EMC Identifier: ESA-2013-040 CVE Identifier: CVE-2013-0947, CVE-2013-1899 Severity Rating: CVSS v2 Base Score: See below for individual scores Affected Products: R...

Peer-to-Peer Botnet Takedowns a Challenge

The FBI, Justice Department and technology companies have had success shutting down botnets that rely on a centralized infrastructure and command and control servers to communicate with bots, steal data or send malicious commands. Peer-to-peer botnets, however, have proven more difficult to take...

CVE-2013-0942

Cross-site scripting XSS vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0941

EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the no...

Cross site scripting

Cross-site scripting XSS vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Input validation

EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the no...

CVE-2013-0941

CVE-2013-0941 affects RSA/SecurID components. The node secret in affected products is stored using a dated encryption algorithm with a weak key, exposing confidentiality and integrity risk for local communications between RSA/Access Manager components. Affected: RSA Authentication API up to 8.1 S...

CVE-2013-0941

EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the no...

CVE-2013-0942

CVE-2013-0942 is an XSS vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for IIS and Web for Apache. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents confirm the affected products and versions and state...

CVE-2013-0942

Cross-site scripting XSS vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...