000035836 - CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products

[#1]

Article Content

Article Number	000035836
CVE ID	CVE-2017-6168, CVE-2017-13098, CVE-2017-13099, CVE-2017-17382, CVE-2017-17427, CVE-2017-17428, CVE-2017-1000385
Article Summary	CERT/CC Vulnerability Note VU#144389: Potential Impact on RSA Products
Resolution	RSA is aware of the work of security researchers Hanno Böck, Juraj Somorovsky, and Craig Young to demonstrate variations of the 1998 Bleichenbacher attack on certain Transport Layer Security (TLS) implementation stacks (also known as a "ROBOT attack").  RSA BSAFE® TLS implementation is not vulnerable to the attack demonstrated by the work of these researchers.  RSA is investigating to identify RSA products that may use any of the impacted TLS implementation stacks. We will update this article with information as it becomes available, with impacted RSA products, if any, and remediation steps, if applicable. Please note:  The RSA keys referred to by CERT/CC VU#144389 have no relation to RSA the security company or the RSA SecurID® algorithm.   RSA Product Name Versions Impacted? Details Last Updated 3D Secure (RSA Adaptive Authentication eCommerce)   Not Impacted   2018-01-26 RSA Access Manager All Supported Not Impacted   2018-01-26 RSA Adaptive Authentication Cloud   Not Impacted No devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process. 2018-02-19 RSA Adaptive Authentication Hosted   Not Impacted No devices are exposed to exploitation of the reported vulnerability. System updates will be handled through the standard RSA vulnerability remediation process. 2018-02-19 RSA Adaptive Authentication On-Prem 7.1.x Not Impacted   2018-02-19 RSA Archer Hosted   Not Impacted   2018-01-26 RSA Archer Platform All Supported Not Impacted   2018-01-26 RSA Archer Security Operations Management (SecOps) All Supported Not Impacted   2018-01-26 RSA Archer Vulnerability & Risk Manager (VRM) All Supported Not Impacted   2018-01-26 RSA Authentication Manager All Supported Not Impacted   2018-01-26 RSA BSAFE C Products: MES, Crypto-C ME, SSL-C All Supported Not Impacted   2018-01-26 RSA BSAFE Java Products: Cert-J, Crypto-J, SSL-J All Supported Not Impacted   2018-01-26 RSA Data Loss Prevention         RSA Data Protection Manager All Supported Not Impacted   2018-01-26 RSA Digital Certificate Solutions: Certificate Manager 6.9 Not Impacted   2018-01-26 RSA Digital Certificate Solutions: Validation Manager 3.2 Not Impacted   2018-01-26 RSA eFraudNetwork (eFN)   Not Impacted The reported issue is not applicable to the service. 2018-02-22 RSA Federated Identity Manager All Supported Not Impacted   2018-01-26 RSA FraudAction (OTMS)         RSA Identity Governance & Lifecycle (Software) All Supported Not Impacted   2018-01-26 RSA Identity Governance & Lifecycle (Appliance) All Supported Not Impacted   2018-01-26 RSA Identity Governance & Lifecycle SaaS/MyAccessLive (MAL) All Supported Not Impacted   2018-01-26 RSA NetWitness Endpoint (ECAT) All Supported Impacted - Remediated The product does not ship or include any of the impacted libraries, but relies on Erlang through RabbitMQ that customers download and install from 3rd party vendor site.  Erlang 20.2, which includes fixes for this issue, has been qualified with NetWitness Endpoint. 2018-08-27 RSA NetWitness Logs & Packets/Security Analytics All Supported Impacted - Remediated Erlang has been updated to version 20.3 in RSA NetWitness 11.2.1.  See RSA NetWitness Platform 11.2.1 Release Notes. 2019-06-10 RSA NetWitness Live Infrastructure         RSA Authentication Agent for Active Directory Federation Services All Supported Not Impacted   2018-01-30 RSA Authentication Agent for Citrix StoreFront All Supported Not Impacted   2018-01-30 RSA Authentication Client (RAC) All Supported Not Impacted   2018-01-30 RSA Central   Not Impacted The reported issue is not applicable to the service. 2018-02-19 RSA SecurID Access Cloud Service         RSA SecurID Access Identity Router (IDR) VM         RSA SecurID Agent for PAM All Supported Not Impacted   2018-01-30 RSA SecurID Agent for Web All Supported Not Impacted   2018-01-30 RSA SecurID Agent for Windows All Supported Not Impacted   2018-01-30 RSA SecurID Authenticate App for Android All Supported Not Impacted   2018-01-30 RSA SecurID Authenticate App for iOS All Supported Not Impacted   2018-01-30 RSA SecurID Authenticate App for Windows 10 All Supported Not Impacted   2018-01-30 RSA SecurID Authentication Engine All Supported Not Impacted   2018-01-30 RSA SecurID Authentication SDK All Supported Not Impacted   2018-01-30 RSA SecurID Software Token Converter All Supported Not Impacted   2018-01-30 RSA SecurID Software Token for Android All Supported Not Impacted   2018-01-30 RSA SecurID Software Token for BlackBerry All Supported Not Impacted   2018-01-30 RSA SecurID Software Token for Windows Desktop All Supported Not Impacted   2018-01-30 RSA SecurID Software Token for iPhone All Supported Not Impacted   2018-01-30 RSA SecurID Software Token for Windows Mobile All Supported Not Impacted   2018-01-30 RSA SecurID Software Token Toolbar All Supported Not Impacted   2018-01-30 RSA SecurID Software Token Web SDK All Supported Not Impacted   2018-01-30 RSA SecurID Transaction Signing SDK All Supported Not Impacted   2018-01-30 SYN   Not Impacted The reported issue is not applicable to the service. 2018-02-19 RSA Web Threat Detection All Supported Not Impacted   2018-02-19
Notes	References: CERT/CC Vulnerability Note: http://www.kb.cert.org/vuls/id/144389 Researcher's website: https://robotattack.org/

Disclaimer

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.