CVE-2016-0887

moderate-risk
Published 2016-04-12

EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by conducting a Lenstra side-channel attack that leverages an application's failure to detect an RSA signature failure during a TLS session.

Do I need to act?

-
0.94% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (5)

Bsafe Ssl-C
Bsafe Crypto-C-Micro-Edition
Bsafe Crypto-J
Bsafe Ssl-J

Affected Vendors

Dell

References (12)

Third Party Advisory http://packetstormsecurity.com/files/136656/RSA-BSAFE-Lenstras-Attack.html
Mailing List http://seclists.org/bugtraq/2016/Apr/66
Third Party Advisory http://www.securityfocus.com/archive/1/538055/100/0/threaded
Third Party Advisory http://www.securitytracker.com/id/1035515
Third Party Advisory http://www.securitytracker.com/id/1035516
Third Party Advisory http://www.securitytracker.com/id/1035517
Third Party Advisory http://packetstormsecurity.com/files/136656/RSA-BSAFE-Lenstras-Attack.html
Mailing List http://seclists.org/bugtraq/2016/Apr/66
Third Party Advisory http://www.securityfocus.com/archive/1/538055/100/0/threaded
Third Party Advisory http://www.securitytracker.com/id/1035515
Third Party Advisory http://www.securitytracker.com/id/1035516
Third Party Advisory http://www.securitytracker.com/id/1035517
33
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 3/34 · Minimal
Exposure 12/34 · Low