RSA BSAFE Crypto-J versions prior to 6.2.2 suffer from improper OCSP validation and PKCS#12 timing attack vulnerabilities.
49ddf75098380770f8fc8cd1d9e75886-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
ESA-2016-154: RSA BSAFE(r) Crypto-J Multiple Security Vulnerabilities
EMC Identifier: ESA-2016-154
CVE Identifier: CVE-2016-8212, CVE-2016-8217
Severity Rating: See below for scores for individual issues
Affected Products:
RSA BSAFE Crypto-J versions prior to 6.2.2
Unaffected Products:
RSA BSAFE Crypto-J 6.2.2
Summary:
RSA announces security fixes to RSA BSAFE(r) Crypto-J designed to address two security vulnerabilities in the Crypto-J JCE cryptographic provider.
Details:
Improper OCSP Validation Vulnerability ( CVE-2016-8212)
OCSP responses have two time values; thisUpdate and nextUpdate. These specify a validity period, however both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.
CVSS v3 Base Score: 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
PKCS#12 Timing Attack Vulnerability (CVE-2016-8217)
A possible timing attack could be carried out by modifying a PKCS#12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS#12 file to the toolkit and guess the current MAC one by at a time. This is possible because Crypto-J uses a non-constant-time method to compare the stored MAC with the calculated MAC. This vulnerability is similar to the issue described in CVE-2015-2601.
CVSS v3 Base Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Recommendation:
The below version contains a fix for the above issues
RSA BSAFE Crypto-J 6.2.2 and later
RSA recommends affected customers upgrade to the version listed above at the earliest opportunity.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBCAAGBQJYiiGvAAoJEHbcu+fsE81ZJ0IH/3r30u14Q5OGi0fImLikb1kI
Hi2SVY+oO56eDtB1H5ivjWqvCabTy9KiwcsPTLx7eGO88ujQ5a0/BH3FjQooCUOM
spa6f8OEKtjhUtJrDS0Hi0UxRcoPlpsuqNnSdrR50/5lgkSfVD2neGCDq3iXyVcU
2uAkxQ9VvETJ5y/R7kEWIrr4QfUZXvb4N9/oclIbsy2hLPYuGN/rx9K2xuN3b0yT
0XaDvL0N08IPrZJbUvTW0C7i0qexaVWMVUqYMDdq2jrnp0X4t5VwlXgO/hOD3HRo
6bvvePtf4N2sipEu3bc0g8JuuzOzy0Xz3wQdEKtUf1qXDa9+RiY+uiDdPY9EJyY=
=JEwf
-----END PGP SIGNATURE-----