CVE-2014-0626

The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:bsafe_ssl-j:5.1.2:::::::*
	cpe:2.3:a:dell:bsafe_ssl-j:6.0:::::::*
	cpe:2.3:a:emc:rsa_bsafe_ssl-j:5.0:::::::*
	cpe:2.3:a:emc:rsa_bsafe_ssl-j:5.1.0:::::::*
	cpe:2.3:a:emc:rsa_bsafe_ssl-j:5.1.1:::::::*
	cpe:2.3:a:emc:rsa_bsafe_ssl-j:6.0.1:::::::*

History

No history.

Information

Published : 2014-02-18 00:55

Updated : 2021-12-09 18:31

NVD link : CVE-2014-0626

Mitre link : CVE-2014-0626

CVE.ORG link : CVE-2014-0626

JSON object : View

Products Affected

emc

rsa_bsafe_ssl-j

dell

bsafe_ssl-j

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2014-0626", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-02-18T00:55:05.173", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2014-02/0061.html", "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated."}, {"lang": "es", "value": "Las APIs (1) JSAFE y (2) JSSE en EMC RSA BSAFE SSL-J 5.x anterior a 5.1.3 y 6.x anterior a 6.0.2 facilitan a atacantes remotos evadir mecanismos de protecci\u00f3n criptogr\u00e1fica mediante el aprovechamiento del procesamiento de datos de la aplicaci\u00f3n durante el handshake de TLS, en el momento cuando los datos no est\u00e1n cifrados ni autenticados."}], "lastModified": "2021-12-09T18:31:15.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:bsafe_ssl-j:5.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "314CC197-7A5B-490E-BCA4-DCFFDC32A50F"}, {"criteria": "cpe:2.3:a:dell:bsafe_ssl-j:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "514F2922-83FA-4A51-BA74-A17175643BE6"}, {"criteria": "cpe:2.3:a:emc:rsa_bsafe_ssl-j:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B160FFB-EF0D-4D7B-9810-3D7728FB0B4C"}, {"criteria": "cpe:2.3:a:emc:rsa_bsafe_ssl-j:5.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "384C4C01-A2CF-4241-97D2-C379F4351DD0"}, {"criteria": "cpe:2.3:a:emc:rsa_bsafe_ssl-j:5.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB1CF0F5-828F-405C-B8E8-D7F8AD15BEF6"}, {"criteria": "cpe:2.3:a:emc:rsa_bsafe_ssl-j:6.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBF5DF8B-B891-4291-A5C2-91C2C2525F53"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}