RSA BSAFE SSL-C Multiple Vulnerabilities

SA50601

CVE-2011-3389, CVE-2012-2110, CVE-2012-2131

12 Sep 2012

Highly Critical

Vendor Patch

RSA BSAFE

From remote

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Hijacking

This covers vulnerabilities where a user session or a communication channel can be taken over by other users or remote attackers.

EMC has acknowledged a weakness and a vulnerability in RSA BSAFE, which can be exploited by malicious people to disclose sensitive information, hijack a user's session, and potentially compromise an application using the library.

For more information:
SA47944
SA48847

The weakness and the vulnerability are reported in RSA BSAFE SSL-C versions prior to 2.8.6.

Update to RSA BSAFE SSL-C version 2.8.6.

http://archives.neohapsis.com/archives/bugtraq/2012-09/att-0046/ESA-2012-029.txt