RSA BSAFE SSL-J Authentication Bypass Vulnerability
BID:3329
Info
RSA BSAFE SSL-J Authentication Bypass Vulnerability
| Bugtraq ID: | 3329 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-1105 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 12 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | Published in a Cisco Systems Security Advisory on September 12, 2001. |
| Vulnerable: |
Rsa BSAFE SSL-J SDK 3.1 Rsa BSAFE SSL-J SDK 3.0.1 Rsa BSAFE SSL-J SDK 3.0 Cisco iCDN 2.0 |
| Not Vulnerable: |
Cisco iCDN 2.0.1 |
Discussion
RSA BSAFE SSL-J Authentication Bypass Vulnerability
A vulnerability exists in several versions of RSA's SSL-J Software Development Kit (SDK) that can enable an attacker to bypass SSL client authentication.
Under certain conditions, if an error occurs during the SSL client-server handshake, the SSL session key may be stored in a cache rather than being discarded. Once cached, this session key can be used by an attacker to cause a server to skip the full client authentication scheme, using a much shorter one. This effectively allows the attacker to fully bypass the client authentication.
On systems that rely solely on the authentication mechanism provided by SSL, this could enable an attacker to perform unauthorized actions.
Additional technical details are forthcoming.
A vulnerability exists in several versions of RSA's SSL-J Software Development Kit (SDK) that can enable an attacker to bypass SSL client authentication.
Under certain conditions, if an error occurs during the SSL client-server handshake, the SSL session key may be stored in a cache rather than being discarded. Once cached, this session key can be used by an attacker to cause a server to skip the full client authentication scheme, using a much shorter one. This effectively allows the attacker to fully bypass the client authentication.
On systems that rely solely on the authentication mechanism provided by SSL, this could enable an attacker to perform unauthorized actions.
Additional technical details are forthcoming.
Exploit / POC
RSA BSAFE SSL-J Authentication Bypass Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
RSA BSAFE SSL-J Authentication Bypass Vulnerability
Solution:
RSA BSAFE SSL-J customers with active maintenance agreements and who currently use an affected version of RSA BSAFE SSL-J are recommended to upgrade to the latest release version of RSA BSAFE SSL-J. Additional information may be found at:
http://www.rsasecurity.com/support/bsafe/index.html
This issue is known to affect version 2.0 of Cisco's iCDN, and has been fixed in version 2.0.1.
Solution:
RSA BSAFE SSL-J customers with active maintenance agreements and who currently use an affected version of RSA BSAFE SSL-J are recommended to upgrade to the latest release version of RSA BSAFE SSL-J. Additional information may be found at:
http://www.rsasecurity.com/support/bsafe/index.html
This issue is known to affect version 2.0 of Cisco's iCDN, and has been fixed in version 2.0.1.
References
RSA BSAFE SSL-J Authentication Bypass Vulnerability
References:
References:
- Cisco Call Manager Express (Cisco Systems)
- RSA Homepage (RSA Security)