Speculative Execution Side-Channel Vulnerabilities (CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646): Impact on RSA products

[#1]

Article Number

000036619

CVE ID

000036619

Article Summary

RSA is aware of a recently disclosed class of CPU speculative execution vulnerabilities (CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646) known collectively as "L1 Terminal Fault" (L1TF) that affect Intel microprocessors. For more information on these vulnerabilities, please review the security advisory posted by Intel.

RSA is investigating the impact of these vulnerabilities on our products and we are working with Intel and other industry partners to mitigate these vulnerabilities. Mitigation steps may vary by product and may include updates to firmware, operating system, and hypervisor components.

RSA recommends customers follow security best practices for malware protection to help prevent possible exploitation of these vulnerabilities until any future updates can be applied. These practices include, but are not limited to, promptly deploying software updates, avoiding unknown hyperlinks and websites, never downloading files or applications from unknown sources, and employing up-to-date anti-virus and advanced threat protection solutions.

For information on other Dell products, please refer to the following link: http://www.dell.com/support/L1-terminal-fault

Link to Advisories

• Intel: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html
• Microsoft: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv180018
• RedHat: https://access.redhat.com/security/vulnerabilities/L1TF
• SuSe: https://www.suse.com/c/suse-addresses-the-l1-terminal-fault-issue/
• Ubuntu: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/L1TF
• VMWare: https://kb.vmware.com/kb/55636

Resolution

 

RSA Product Name	Versions	Impact Status	Details	Last Updated
3D Secure / Adaptive Authentication eCommerce	Current Hosted Environment	No additional security risk	See Note 2.	2018-08-14
Access Manager	6.2	No direct impact	See Note 1.	2018-08-14
Adaptive Authentication Cloud	Current Hosted Environment	No additional security risk	We have confirmed that our third party cloud platform provider has remediated the issue at the platform level.	2018-08-15
Adaptive Authentication Hosted	Current Hosted Environment	No additional security risk	See Note 2.	2018-08-14
Adaptive Authentication On-Prem	All Supported	No direct impact	See Note 1.	2018-08-14
Archer Hosted (US)	Current Hosted Environment	No additional security risk	See Note 2.	2018-08-14
Archer Hosted (EMEA)	Current Hosted Environment	No additional security risk	See Note 2.	2018-08-14
Archer Platform	All Supported	No direct impact	See Note 1.	2018-08-14
Archer Security Operations Management (SecOps)	All Supported	No direct impact	See Note 1.	2018-08-14
Archer Vulnerability & Risk Manager (VRM) - Hardware Appliance	All Supported	No additional security risk	See Note 3.	2018-08-14
Archer Vulnerability & Risk Manager (VRM) - Virtual Appliance	All Supported	No additional security risk	See Note 3. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.	2018-08-14
Authentication Manager (Hardware Appliance - Dell PowerEdge & Intel platforms)	All Supported	No additional security risk	See Note 3.	2018-08-14
Authentication Manager (Virtual Appliance)	All Supported	No additional security risk	See Note 3. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.	2018-08-14
Authentication Manager Web Tier	All Supported	No direct impact	See Note 1.	2018-08-14
BSAFE C Products: MES, Crypto-C ME, SSL-C	All Supported	No direct impact	See Note 1.	2018-08-14
BSAFE Java Products: Cert-J, Crypto-J, SSL-J	All Supported	No direct impact	See Note 1.	2018-08-14
Data Loss Prevention (Hardware Appliance)	All Supported	Impacted	Remediation plan in progress.	2018-08-14
Data Loss Prevention (Virtual Appliance)	All Supported	Impacted	Remediation plan in progress. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.	2018-08-14
Data Protection Manager (Software)	All Supported	No direct impact	See Note 1.	2018-08-14
Data Protection Manager (Hardware Appliance)	All Supported	Impacted - Remediated	RSA Data Protection Manager 3.5.2.7 contains resolution for this issue. For more details, refer to the security advisory DSA-2018-189.	2018-10-02
Data Protection Manager (Virtual Appliance)	All Supported	Impacted - Remediated	RSA Data Protection Manager 3.5.2.7 contains resolution for this issue. For more details, refer to the security advisory DSA-2018-189. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.	2018-10-02
DCS: Certificate Manager	6.9	No direct impact	See Note 1.	2018-08-14
DCS: Validation Manager	3.2	No direct impact	See Note 1.	2018-08-14
eFraudNetwork (eFN)	Current Hosted Environment	No additional security risk	See Note 2.	2018-08-14
enVision	EOL		The product has reached End of Life. Please refer to the Product Version Life Cycle for RSA enVision page on RSA Link.	2018-08-14
Federated Identity Manager	4.2	No direct impact	See Note 1.	2018-08-14
FraudAction (OTMS)	Current Hosted Environment	No additional security risk	See Note 2.	2018-08-14
Identity Governance & Lifecycle (Software), Via Lifecycle & Governance (Software), Identity Management & Governance (Software)	7.1, 7.0.2, 7.0.1, 7.0, 6.9.1, 6.9.0	No direct impact	See Note 1.	2018-08-14
Identity Governance & Lifecycle (Hardware Appliance), Via Lifecycle & Governance (Hardware Appliance), Identity Management & Governance (Hardware Appliance)	7.1, 7.0.2, 7.0.1, 7.0, 6.9.1, 6.9.0	Impacted - Remediated	Refer to the security advisory DSA-2018-202. Any Remote Agents or Remote AFX deployed in customer environment are a software product only and have no direct impact. See Note 1.	2018-10-26
Identity Governance & Lifecycle (Virtual Application)	7.1	Impacted - Remediated	Refer to the security advisory DSA-2018-202. Customers are strongly advised to also patch the virtual host environment where the product is deployed for full protection. Any Remote Agents or Remote AFX deployed in customer environment are a software product only and have no direct impact. See Note 1.	2018-10-26
Identity Governance & Lifecycle SaaS / MyAccessLive		Under investigation	Any Remote Agents or Remote AFX deployed in customer environment are a software product only and have no direct impact. See Note 1.	2018-08-14
NetWitness Endpoint (ECAT)	All Supported	No direct impact	See Note 1.	2018-08-14
NetWitness Logs & Packets / Security Analytics (Hardware Appliance)	All Supported	No additional security risk	See Note 3.	2018-08-14
NetWitness Logs & Packets / Security Analytics (Virtual Appliance)	All Supported	No additional security risk	See Note 3. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.	2018-08-14
NetWitness Logs & Packets / Security Analytics - Legacy Windows Collector	All Supported	No direct impact	See Note 1.	2018-08-14
NetWitness Live Infrastructure	Current Hosted Environment	No additional security risk	We have confirmed that our third party cloud platform provider has remediated the issue at the platform level.	2018-08-15
RSA Authentication Client (RAC)	All Supported	No direct impact	See Note 1.	2018-08-14
RSA Central	Current Hosted Environment	No additional security risk	See Note 2.	2018-08-14
SecurID Access Cloud Service	Current Hosted Environment	No additional security risk	We have confirmed that our third party cloud platform provider has remediated the issue at the platform level.	2018-08-15
SecurID Access IDR VM	All Supported	No additional security risk	See Note 2. Customers are strongly advised to patch the virtual host environment where the product is deployed for full protection.	2018-08-14
SecurID Agent for PAM	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Agent for Web	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Agent for Windows	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Authenticate App for Android	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Authenticate App for iOS	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Authenticate App for Windows 10	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Authentication Engine	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Authentication SDK	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token Converter	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token for Android	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token for Blackberry	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token for Desktop	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token for iPhone	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token for Windows Mobile	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token Toolbar	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Software Token Web SDK	All Supported	No direct impact	See Note 1.	2018-08-14
SecurID Transaction Signing SDK	All Supported	No direct impact	See Note 1.	2018-08-14
SYN	Current Hosted Environment	No additional security risk	We have confirmed that our third party cloud platform provider has remediated the issue at the platform level.	2018-08-15
Web Threat Detection	All Supported	No direct impact	See Note 1.	2018-08-14

Note 1: It is a software product only. Reported vulnerabilities are best mitigated via firmware and operating system updates. Customers are strongly advised to patch their host systems where the product is installed.

Note 2: To take advantage of these vulnerabilities, an attacker first must be able to run malicious code on the targeted system. The product is designed to prevent users from loading and executing any external and/or untrusted code on the system. The reported issues do not introduce any additional security risk to the product.

Note 3: ​To take advantage of these vulnerabilities, an attacker first must be able to run malicious code on the targeted system. Access to the product to load external and/or potentially untrusted code is restricted to users with root or root-equivalent privileges only. The reported issues do not introduce any additional security risk to the product, provided the recommended best practices to protect the access of highly privileged account are followed.

Notes

For information on other Dell products, please see http://www.dell.com/support/L1-terminal-fault