1. CVE-Search
  2. CVE-2013-0941
ID CVE-2013-0941
Summary EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data. Per: http://archives.neohapsis.com/archives/bugtraq/2013-05/att-0064/ESA-2013-029.txt "RSA SecurID Sensitive Information Disclosure Vulnerability"
References
Vulnerable Configurations
  • cpe:2.3:a:rsa:authentication_api:8.1:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:authentication_api:8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rsa:authentication_api:8.1:sp1:*:*:*:*:*:*
    cpe:2.3:a:rsa:authentication_api:8.1:sp1:*:*:*:*:*:*
  • cpe:2.3:a:rsa:securid_web_agent:-:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:securid_web_agent:-:*:*:*:*:*:*:*
  • cpe:2.3:a:rsa:securid_web_agent:5:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:securid_web_agent:5:*:*:*:*:*:*:*
  • cpe:2.3:a:rsa:securid_web_agent:5.2:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:securid_web_agent:5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:rsa:securid_web_agent:5.3:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:securid_web_agent:5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:rsa:securid_web_agent:5.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:securid_web_agent:5.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*
  • cpe:2.3:a:rsa:pluggable_authentication_module_agent:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:pluggable_authentication_module_agent:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rsa:authentication_agent:6.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:rsa:authentication_agent:6.1.3:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
CVSS
Base: 2.1 (as of 23-05-2013 - 04:00)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:N/A:N
refmap via4
bugtraq 20130516 ESA-2013-029: RSA SecurID Sensitive Information Disclosure Vulnerability
Last major update 23-05-2013 - 04:00
Published 22-05-2013 - 13:29
Last modified 23-05-2013 - 04:00
Back to Top